CVE-2025-5014
HIGH EPSS 46.9%
Published Jul 2, 202512mo ago · Modified Jun 17, 20262w ago
8.8 CVSS 3.1
Published Jul 2, 2025 12mo ago
Last Modified Jun 17, 2026 2w ago
Description
The Home Villas | Real Estate WordPress Theme theme for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'wp_rem_cs_widget_file_delete' function in all versions up to, and including, 2.8. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
CVSS Details
Base Score
Exploitability
Impact
Vector string
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Attack Vector Network
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality High
Integrity High
Availability High
Threat Intelligence
EPSS Exploit Probability
46.9% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available
Weaknesses 1
CWE-22 Path Traversal Resource Mgmt
References 2
- localhost http://localhost:1337/wp-content/themes/homevillas-real-estate/include/backend/cs-widgets/import/cs-class-widget-data.php#L384
- wordfence.com https://www.wordfence.com/threat-intel/vulnerabilities/id/afd4f2ca-9c27-4de0-ac82-3cd107b6a092?source=cve
Remediation
No remediation data recorded yet
Check vendor advisories and the NVD entry for patch availability.