CVE-2025-10690 is a critical missing authorization vulnerability (CWE-862) in the Bearsthemes Goza - Nonprofit Charity WordPress Theme, affecting all versions up to 3.2.2. The issue arises from the lack of capability checks in the 'beplus_import_pack_install_plugin' function, which handles plugin imports. This allows unauthenticated attackers to upload arbitrary zip files remotely, which can contain malicious webshells disguised as plugins, leading to remote code execution. The vulnerability is network exploitable without authentication or user interaction, with high impact on confidentiality, integrity, and availability as reflected by the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. No patch or official fix has been disclosed yet.

Successful exploitation allows unauthenticated remote attackers to upload arbitrary files disguised as plugins, resulting in remote code execution on the affected WordPress site. This compromises the confidentiality, integrity, and availability of the system, potentially allowing full site takeover. The vulnerability is critical and can be exploited over the network without any privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to plugin installation functionality, disable or remove the vulnerable theme if possible, and monitor for suspicious file uploads. Avoid exposing the WordPress admin or theme-specific endpoints to untrusted networks. Follow vendor updates closely for an official patch or mitigation instructions.