Threat Entry Updated 2025-07-03

CVE-2025-4946 - Vikinger Theme

The Vikinger theme for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the vikinger_delete_activity_media_ajax() function in all versions up to, and including, 1.9.32. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). Note: Requires Vikinger Media plugin to be installed and active.

THEME Vikinger

CVE-2025-4946

HIGH CVSS 8.1 2025-07-02

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2025-04-29

CVE-2025-2238 - Vikinger Theme

The Vikinger theme for WordPress is vulnerable to privilege in all versions up to, and including, 1.9.30. This is due to insufficient user_meta restrictions in the 'vikinger_user_meta_update_ajax' function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to escalate their privileges to Administrator-level.

THEME Vikinger

CVE-2025-2238

HIGH CVSS 8.8 2025-04-25

Risk Score

Open Full Technical Breakdown