CVE-2025-4946: Vikinger WordPress Theme RCE Vulnerability

CVE-2025-4946 Overview

CVE-2025-4946 is an arbitrary file deletion vulnerability in the Vikinger theme for WordPress. The flaw resides in the vikinger_delete_activity_media_ajax() function, which fails to properly validate file paths before deletion. All versions up to and including 1.9.32 are affected when the Vikinger Media plugin is installed and active.

Authenticated attackers with Subscriber-level access or above can delete arbitrary files on the server. Deleting sensitive files such as wp-config.php can lead to remote code execution by forcing WordPress into setup mode, where an attacker can connect the site to a database under their control.

Critical Impact
Authenticated low-privilege users can delete arbitrary server files, enabling site takeover and remote code execution through deletion of wp-config.php.

Affected Products

Vikinger BuddyPress and GamiPress Social Community theme for WordPress
All versions up to and including 1.9.32
Requires the Vikinger Media plugin to be installed and active

Discovery Timeline

2025-07-02 - CVE-2025-4946 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-4946

Vulnerability Analysis

The vulnerability is classified as a Path Traversal weakness [CWE-22]. The vikinger_delete_activity_media_ajax() function accepts user-supplied input identifying a media file to delete, but does not adequately validate or sanitize the supplied file path. As a result, the function operates on attacker-controlled paths outside the intended media directory.

Because the AJAX endpoint is accessible to authenticated users at the Subscriber tier or higher, the exploitation barrier is minimal on sites that allow open registration. WordPress sites with public registration are the most exposed.

Deletion of wp-config.php is the most impactful exploitation path. When WordPress detects the missing configuration file, it redirects visitors to the installation wizard. An attacker who reaches the wizard first can point the site at a database they control and execute arbitrary PHP, completing a full site takeover.

Root Cause

The root cause is insufficient validation of file path parameters passed to the vikinger_delete_activity_media_ajax() AJAX handler. The function does not constrain deletions to the intended upload directory, does not normalize path traversal sequences such as ../, and does not verify that the caller owns the target media item.

Attack Vector

The attack is remote and authenticated. An attacker registers an account on a vulnerable WordPress site, authenticates, then issues a crafted POST request to the WordPress AJAX endpoint invoking vikinger_delete_activity_media_ajax. The request includes a file path parameter referencing a target file outside the media directory. The server processes the path and deletes the referenced file.

For technical details, see the Wordfence Vulnerability Report and the ThemeForest Product Page.

Detection Methods for CVE-2025-4946

Indicators of Compromise

Unexpected deletion of wp-config.php or other PHP files in the WordPress root directory
WordPress installation wizard appearing on a previously configured site
POST requests to /wp-admin/admin-ajax.php with the action=vikinger_delete_activity_media_ajax parameter from low-privilege accounts
New Subscriber-level account registrations followed shortly by AJAX requests targeting the Vikinger media handler

Detection Strategies

Inspect web server access logs for POST requests to admin-ajax.php containing the vikinger_delete_activity_media action and path traversal sequences such as ../
Monitor file integrity for the WordPress root and wp-content directories to flag unexpected file deletions
Audit WordPress user registration logs for anomalous Subscriber accounts created prior to suspicious AJAX activity

Monitoring Recommendations

Enable verbose logging on admin-ajax.php and forward to a centralized logging platform
Alert on creation of new Subscriber accounts followed by AJAX calls within a short time window
Track file system change events for critical WordPress files including wp-config.php, .htaccess, and theme functions.php

How to Mitigate CVE-2025-4946

Immediate Actions Required

Update the Vikinger theme to a version newer than 1.9.32 once the vendor publishes a fix
Disable open user registration on WordPress until the theme is patched, or restrict registration to trusted users
Back up wp-config.php and other critical files to an out-of-webroot location
Audit existing Subscriber-level accounts and remove any that are not legitimate

Patch Information

At the time of publication, no fixed version is listed in the available references. Site administrators should monitor the ThemeForest Product Page for vendor updates and apply the patched release as soon as it is available.

Workarounds

Deactivate the Vikinger Media plugin until a patched theme version is released, as the vulnerability requires this plugin to be active
Set the WordPress users_can_register option to 0 to block self-registration
Apply a web application firewall rule blocking admin-ajax.php requests with action=vikinger_delete_activity_media_ajax containing path traversal characters
Restrict file system permissions so the PHP process cannot delete files outside the wp-content/uploads directory

bash

# Disable open registration via WP-CLI
wp option update users_can_register 0

# Deactivate the dependent Vikinger Media plugin
wp plugin deactivate vikinger-media