CVE-2025-4946: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Odin_Design Vikinger
The Vikinger theme for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the vikinger_delete_activity_media_ajax() function in all versions up to, and including, 1.9.32. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). Note: Requires Vikinger Media plugin to be installed and active.
AI Analysis
Technical Summary
CVE-2025-4946 is a path traversal vulnerability (CWE-22) in the Vikinger WordPress theme by Odin_Design. The issue arises from insufficient validation of file paths in the vikinger_delete_activity_media_ajax() function, enabling authenticated attackers with Subscriber-level privileges or higher to delete arbitrary files on the server. This can lead to remote code execution if key files are removed. The vulnerability affects all versions up to 1.9.32 and requires the Vikinger Media plugin to be active. The CVSS v3.1 base score is 8.1, indicating high severity. No patch or official fix has been documented at this time.
Potential Impact
An attacker with low-level authenticated access (Subscriber or above) can delete arbitrary files on the server due to improper path validation. This can result in denial of service or remote code execution if critical files such as wp-config.php are deleted. The vulnerability compromises the integrity and availability of the affected WordPress installation.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Subscriber-level user permissions where possible and consider disabling or uninstalling the Vikinger Media plugin if not required. Monitor for updates from Odin_Design regarding patches or mitigations.
CVE-2025-4946: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Odin_Design Vikinger
Description
The Vikinger theme for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the vikinger_delete_activity_media_ajax() function in all versions up to, and including, 1.9.32. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). Note: Requires Vikinger Media plugin to be installed and active.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2025-4946 is a path traversal vulnerability (CWE-22) in the Vikinger WordPress theme by Odin_Design. The issue arises from insufficient validation of file paths in the vikinger_delete_activity_media_ajax() function, enabling authenticated attackers with Subscriber-level privileges or higher to delete arbitrary files on the server. This can lead to remote code execution if key files are removed. The vulnerability affects all versions up to 1.9.32 and requires the Vikinger Media plugin to be active. The CVSS v3.1 base score is 8.1, indicating high severity. No patch or official fix has been documented at this time.
Potential Impact
An attacker with low-level authenticated access (Subscriber or above) can delete arbitrary files on the server due to improper path validation. This can result in denial of service or remote code execution if critical files such as wp-config.php are deleted. The vulnerability compromises the integrity and availability of the affected WordPress installation.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Subscriber-level user permissions where possible and consider disabling or uninstalling the Vikinger Media plugin if not required. Monitor for updates from Odin_Design regarding patches or mitigations.
Technical Details
- Data Version
- 5.1
- Assigner Short Name
- Wordfence
- Date Reserved
- 2025-05-19T05:22:38.122Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6864fe536f40f0eb72923f1a
Added to database: 7/2/2025, 9:39:31 AM
Last enriched: 4/9/2026, 9:35:34 PM
Last updated: 5/9/2026, 2:54:47 AM
Views: 171
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.