CVE-2025-1282: Arbitrary File Access in Car Dealer Theme

The primary impact of CVE-2025-1282 is the ability for an authenticated attacker to delete files on the WordPress server. While the vulnerability requires Subscriber-level access, this is a common user role, making a large number of sites potentially vulnerable. The most critical scenario involves deleting the wp-config.php file, which contains sensitive database credentials and configuration settings. Deletion of this file would effectively disable the WordPress site and potentially allow an attacker to gain control of the database. The description also indicates the possibility of reading arbitrary files via the add_car() function, although file deletion presents the more immediate and severe risk. This vulnerability shares similarities with other file access vulnerabilities in WordPress themes where insufficient input validation allows for unauthorized file manipulation.

1. Reserved2025-02-13
2. Published2025-02-27
3. Modified2026-04-08
4. EPSS updated2026-04-02

The primary mitigation for CVE-2025-1282 is to upgrade the Car Dealer Automotive WordPress Theme – Responsive to a version that includes the fix. If an immediate upgrade is not possible due to compatibility issues or breaking changes, consider implementing temporary workarounds. These may include restricting file permissions on the server to prevent unauthorized file deletion, or implementing a Web Application Firewall (WAF) rule to block requests that attempt to access or delete files outside of designated directories. Regularly review WordPress plugin and theme updates to proactively address potential vulnerabilities. After upgrading, confirm the fix by attempting to access and delete files outside of the intended upload directories using an authenticated user account with Subscriber privileges.