Eleganzo <= 1.2 - Authenticated (Subscriber+) Arbitrary Directory Deletion

An attacker exploiting CVE-2025-15470 can leverage their subscriber-level access to delete arbitrary directories on the server. This includes the potential to delete the WordPress root directory, effectively crippling the website. While not a direct remote code execution vulnerability, the ability to delete critical files can have a devastating impact, leading to data loss, website downtime, and potential compromise of the underlying server. The blast radius encompasses all files and directories accessible to the vulnerable function.

1. Reserviert2026-01-06
2. Veröffentlicht2026-04-15
3. EPSS aktualisiert2026-04-22

The primary mitigation for CVE-2025-15470 is to upgrade the Eleganzo WordPress theme to version 1.3 or later. If upgrading is not immediately possible, restrict file system permissions to prevent subscriber-level users from deleting files. Implement a Web Application Firewall (WAF) rule to block requests containing malicious directory deletion attempts. Monitor server logs for unusual file deletion activity. After upgrading, verify the fix by attempting to delete a test directory with a subscriber-level account.