विकिजर <= 1.9.32 - प्रमाणित (सदस्य+) विकिजर_डिलीट_एक्टिविटी_मीडिया_एजैक्स फ़ंक्शन के माध्यम से मनमाना फ़ाइल विलोपन

The primary impact of CVE-2025-4946 is the potential for remote code execution (RCE). While the vulnerability requires authentication, the relatively low privilege level (Subscriber) makes it accessible to a significant portion of WordPress users. An attacker could delete critical files, such as wp-config.php, which contains sensitive database credentials and configuration settings. Deletion of this file would effectively disable the WordPress site and potentially allow the attacker to gain control of the database and server. The Vikinger Media plugin dependency expands the attack surface, as the vulnerability is tied to its functionality. The ease of file deletion, combined with the potential for RCE, makes this a high-risk vulnerability.

WordPress websites using the Vikinger theme, particularly those with the Vikinger Media plugin installed and active, are at risk. Sites with weak password policies or overly permissive user roles are especially vulnerable, as an attacker could easily gain Subscriber-level access. Shared hosting environments where multiple WordPress sites share the same server resources are also at increased risk, as a compromise of one site could potentially lead to the compromise of others.

• wordpress / composer / npm:

grep -r 'vikinger_delete_activity_media_ajax' /var/www/html/wp-content/plugins/

• wordpress / composer / npm:

wp plugin list | grep vikinger

• wordpress / composer / npm:

curl -I http://your-wordpress-site.com/wp-admin/admin-ajax.php?action=vikinger_delete_activity_media_ajax | grep -i '200 OK'

1. 2025-07-02Disclosure

   disclosure

1. आरक्षित2025-05-19
2. प्रकाशित2025-07-02
3. संशोधित2026-04-08
4. EPSS अद्यतन2026-03-23

The primary mitigation for CVE-2025-4946 is to upgrade the Vikinger WordPress theme to a patched version. The vendor has not yet released a fixed version, so immediate action is required. As a temporary workaround, restrict file permissions on sensitive files like wp-config.php to prevent unauthorized access and modification. Consider implementing a Web Application Firewall (WAF) with rules to block suspicious file deletion requests targeting the vikingerdeleteactivitymediaajax() endpoint. Regularly review WordPress user roles and permissions to ensure that only authorized users have access to administrative functions. After upgrading, verify the integrity of the WordPress installation by checking for any unauthorized file modifications and confirming that the Vikinger Media plugin is functioning as expected.