CVE-2025-15470: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in DesigningMedia Eleganzo
The Eleganzo WordPress theme by DesigningMedia contains a path traversal vulnerability (CWE-22) in the akd_required_plugin_callback function. This flaw allows authenticated users with Subscriber-level access or higher to delete arbitrary directories on the server, including critical directories such as the WordPress root. The vulnerability affects all versions up to and including 1. 2. No official patch or remediation guidance has been provided yet. The CVSS 3. 1 base score is 6. 5, indicating a medium severity level with high impact on integrity but no impact on confidentiality or availability.
AI Analysis
Technical Summary
CVE-2025-15470 is a path traversal vulnerability in the Eleganzo WordPress theme (DesigningMedia) that permits authenticated attackers with low privileges (Subscriber and above) to delete arbitrary directories on the server. The vulnerability arises from insufficient validation of file paths in the akd_required_plugin_callback function, enabling directory deletion including the WordPress root directory. This vulnerability affects all versions up to 1.2. There is no vendor advisory or patch available at this time, and no known exploits have been reported in the wild.
Potential Impact
An attacker with Subscriber-level access can delete arbitrary directories on the server, compromising the integrity of the WordPress installation and potentially causing significant disruption. There is no direct impact on confidentiality or availability as per the CVSS vector, but the ability to delete directories can lead to denial of service or site breakage.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Subscriber-level access and higher to trusted users only. Monitor for updates from DesigningMedia regarding an official patch or mitigation.
CVE-2025-15470: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in DesigningMedia Eleganzo
Description
The Eleganzo WordPress theme by DesigningMedia contains a path traversal vulnerability (CWE-22) in the akd_required_plugin_callback function. This flaw allows authenticated users with Subscriber-level access or higher to delete arbitrary directories on the server, including critical directories such as the WordPress root. The vulnerability affects all versions up to and including 1. 2. No official patch or remediation guidance has been provided yet. The CVSS 3. 1 base score is 6. 5, indicating a medium severity level with high impact on integrity but no impact on confidentiality or availability.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2025-15470 is a path traversal vulnerability in the Eleganzo WordPress theme (DesigningMedia) that permits authenticated attackers with low privileges (Subscriber and above) to delete arbitrary directories on the server. The vulnerability arises from insufficient validation of file paths in the akd_required_plugin_callback function, enabling directory deletion including the WordPress root directory. This vulnerability affects all versions up to 1.2. There is no vendor advisory or patch available at this time, and no known exploits have been reported in the wild.
Potential Impact
An attacker with Subscriber-level access can delete arbitrary directories on the server, compromising the integrity of the WordPress installation and potentially causing significant disruption. There is no direct impact on confidentiality or availability as per the CVSS vector, but the ability to delete directories can lead to denial of service or site breakage.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Subscriber-level access and higher to trusted users only. Monitor for updates from DesigningMedia regarding an official patch or mitigation.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Wordfence
- Date Reserved
- 2026-01-06T11:36:51.018Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 69dece6882d89c981f1bf9d4
Added to database: 4/14/2026, 11:31:52 PM
Last enriched: 4/14/2026, 11:48:05 PM
Last updated: 4/15/2026, 2:15:39 AM
Views: 7
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.