Car Dealer Automotive WordPress Theme – Responsive <= 1.6.3 - Authenticated (Subscriber+) Arbitrary File Deletion and Read

The primary impact of CVE-2025-1282 is the ability for an authenticated attacker to delete arbitrary files on the web server. This is particularly concerning because the attacker can target critical configuration files, such as wp-config.php, which contains database credentials and other sensitive information. Deletion of wp-config.php can lead to complete compromise of the WordPress installation, allowing the attacker to gain full control over the server. The vulnerability also allows for the potential reading of arbitrary files, further expanding the attacker's reconnaissance capabilities. This vulnerability shares similarities with other file access vulnerabilities in WordPress themes where insufficient input validation allows for manipulation of file paths.

WordPress websites using the Car Dealer Automotive WordPress Theme – Responsive are at risk. Specifically, sites running versions 1.0.0 through 1.6.3 are vulnerable. Shared hosting environments are particularly at risk, as they often have limited control over file permissions and security configurations. Sites with weak password policies or compromised user accounts are also more susceptible to exploitation.

• wordpress / composer / npm:

wp plugin list | grep 'Car Dealer Automotive WordPress Theme'

• wordpress / composer / npm:

wp plugin update --all

• wordpress / composer / npm:

grep -r 'delete_post_photo' /var/www/html/wp-content/plugins/car-dealer-responsive/

• wordpress / composer / npm:

wp plugin status | grep 'Car Dealer Automotive WordPress Theme'

1. 2025-02-27Disclosure

   disclosure

1. Reserviert2025-02-13
2. Veröffentlicht2025-02-27
3. Geändert2026-04-08
4. EPSS aktualisiert2026-04-02

The primary mitigation for CVE-2025-1282 is to upgrade the Car Dealer Automotive WordPress Theme – Responsive to a version that includes the fix. If immediate upgrading is not possible due to compatibility issues or breaking changes, consider implementing temporary workarounds. These may include restricting file permissions on the WordPress installation to prevent unauthorized file deletion, and implementing a Web Application Firewall (WAF) rule to block requests that attempt to access or delete files outside of the designated upload directories. Regularly review WordPress plugin and theme updates to ensure timely patching of vulnerabilities.