CVE-2025-7778: Icons Factory Path Traversal Vulnerability

CVE-2025-7778 Overview

The Icons Factory plugin for WordPress contains a critical arbitrary file deletion vulnerability in versions up to and including 1.6.12. The vulnerability stems from insufficient authorization controls and improper path validation within the delete_files() function, allowing unauthenticated attackers to delete arbitrary files on the server. When critical files such as wp-config.php are deleted, this can lead to remote code execution, enabling complete site compromise.

Critical Impact

Unauthenticated attackers can delete arbitrary server files, potentially leading to remote code execution through deletion of critical WordPress configuration files.

Affected Products

• Icons Factory WordPress Plugin versions up to and including 1.6.12
• WordPress installations with Icons Factory plugin active
• Web servers hosting vulnerable WordPress configurations

Discovery Timeline

• 2025-08-15 - CVE-2025-7778 published to NVD
• 2025-08-15 - Last updated in NVD database

Technical Details for CVE-2025-7778

Vulnerability Analysis

This vulnerability is classified under CWE-285 (Improper Authorization), indicating a fundamental flaw in how the plugin validates user permissions before executing file system operations. The delete_files() function in the Icons Factory plugin fails to implement proper authorization checks, meaning it does not verify whether the requesting user has the necessary permissions to perform file deletion operations.

Additionally, the function lacks sufficient path validation, enabling path traversal attacks. Attackers can manipulate file path parameters to escape the intended directory structure and target files anywhere on the server filesystem. The combination of these two weaknesses—missing authorization and improper path validation—creates a severe security flaw that can be exploited without any authentication.

The most dangerous exploitation scenario involves deleting wp-config.php, which contains database credentials and security keys. When this file is removed, WordPress enters installation mode, allowing attackers to reconfigure the site with their own database and gain administrative access, effectively achieving remote code execution capabilities.

Root Cause

The root cause is twofold: the delete_files() function at line 1330 of icons-factory.php does not implement WordPress capability checks (such as current_user_can()) to verify user authorization, and it fails to properly sanitize file paths to prevent directory traversal sequences like ../. This allows unauthenticated users to construct requests that traverse outside the plugin's intended directory scope and delete arbitrary files.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker can send crafted HTTP requests directly to the vulnerable endpoint, specifying file paths that include directory traversal sequences. By targeting critical WordPress files or server configuration files, the attacker can destabilize the site or create conditions that enable further exploitation.

The vulnerability mechanism involves manipulating the file parameter passed to the delete_files() function. Since no authorization check is performed and path validation is insufficient, the function processes malicious input and executes the file deletion operation. For technical implementation details, refer to the WordPress Plugin Code Reference.

Detection Methods for CVE-2025-7778

Indicators of Compromise

• Unexpected deletion of WordPress core files, especially wp-config.php
• Web server error logs showing 404 errors for previously existing files
• WordPress site entering installation/setup mode unexpectedly
• Unusual HTTP requests to Icons Factory plugin endpoints containing path traversal patterns

Detection Strategies

• Monitor web server access logs for requests containing ../ sequences targeting the Icons Factory plugin
• Implement file integrity monitoring (FIM) on critical WordPress files including wp-config.php, .htaccess, and core PHP files
• Deploy web application firewall (WAF) rules to detect and block path traversal attempts
• Set up alerts for HTTP requests to plugin endpoints from unauthenticated sessions

Monitoring Recommendations

• Enable detailed WordPress debug logging to capture suspicious plugin activity
• Configure real-time file system change notifications for the WordPress installation directory
• Review access logs regularly for patterns of requests to the Icons Factory plugin from unusual IP addresses
• Implement network-level monitoring for outbound connections that may indicate post-exploitation activity

How to Mitigate CVE-2025-7778

Immediate Actions Required

• Update the Icons Factory plugin to a patched version immediately if one is available
• If no patch is available, deactivate and remove the Icons Factory plugin from all WordPress installations
• Audit file system integrity to ensure no critical files have been deleted
• Review server access logs for evidence of exploitation attempts
• Consider implementing additional WAF rules to block path traversal attacks

Patch Information

Users should check the Icons Factory plugin page for updates and security patches. Additional vulnerability analysis is available from the Wordfence threat intelligence report. Until a patch is applied, the plugin should be considered unsafe for production use.

Workarounds

• Completely disable the Icons Factory plugin until a security patch is released
• Implement server-level file permissions to make critical files read-only where possible
• Deploy a web application firewall with rules to block requests containing directory traversal patterns
• Restrict access to WordPress admin and plugin directories via server configuration

# Example: Restrict plugin directory access and protect wp-config.php
# Add to .htaccess in WordPress root directory

# Deny direct access to Icons Factory plugin
<Directory "/path/to/wp-content/plugins/icons-factory">
    Order Deny,Allow
    Deny from all
</Directory>

# Protect wp-config.php from deletion attempts
<Files wp-config.php>
    Order Allow,Deny
    Deny from all
</Files>