Vikinger <= 1.9.32 - Authentifiziert (Abonnent+) Willkürliches Löschen von Dateien über die Funktion vikinger_delete_activity_media_ajax

The primary impact of CVE-2025-4946 is the ability for an authenticated attacker to delete arbitrary files on a WordPress server. While requiring Subscriber-level access, this is a relatively low privilege, making a large number of WordPress sites potentially vulnerable. The most critical scenario involves deleting the wp-config.php file, which contains sensitive database credentials and configuration settings. Deletion of this file would effectively disable the WordPress site and potentially allow the attacker to gain control of the database. Successful exploitation could lead to complete compromise of the web server and data exfiltration. This vulnerability shares similarities with other file deletion vulnerabilities where the deletion of critical configuration files can lead to significant system disruption.

WordPress websites using the Vikinger theme, particularly those with the Vikinger Media plugin installed and active, are at risk. Sites with weak password policies or overly permissive user roles are especially vulnerable, as an attacker could easily gain Subscriber-level access. Shared hosting environments where multiple WordPress sites share the same server resources are also at increased risk, as a compromise of one site could potentially lead to the compromise of others.

• wordpress / composer / npm:

grep -r 'vikinger_delete_activity_media_ajax' /var/www/html/wp-content/plugins/

• wordpress / composer / npm:

wp plugin list | grep vikinger

• wordpress / composer / npm:

curl -I http://your-wordpress-site.com/wp-admin/admin-ajax.php?action=vikinger_delete_activity_media_ajax | grep -i '200 OK'

1. 2025-07-02Disclosure

   disclosure

1. Reserviert2025-05-19
2. Veröffentlicht2025-07-02
3. Geändert2026-04-08
4. EPSS aktualisiert2026-03-23

Since a patched version of the Vikinger WordPress theme is not yet available, immediate mitigation steps are essential. The most effective short-term solution is to implement a Web Application Firewall (WAF) rule that blocks requests to the vikingerdeleteactivitymediaajax() endpoint, specifically filtering for potentially malicious file paths. Alternatively, restrict file permissions on the WordPress server to prevent the webserver user from deleting files outside of the designated WordPress directory. Disable the Vikinger Media plugin if it is not essential. Regularly monitor WordPress logs for suspicious activity, particularly attempts to access or modify files. After implementing these mitigations, verify their effectiveness by attempting to access the vulnerable endpoint with a controlled, non-destructive request.