CVE-2025-6755

Name of the Vulnerable Software and Affected Versions: Game Users Share Buttons plugin for WordPress versions up to, and including, 1.3.0

Description: The issue is related to insufficient file path validation in the ajaxDeleteTheme() function, allowing Subscriber-level attackers to add arbitrary file paths to the themeNameId parameter of the AJAX request. This can lead to remote code execution. For example, attackers can use paths like ../../../../wp-config.php.

Recommendations: For versions up to, and including, 1.3.0, update to a version that fixes the insufficient file path validation issue in the ajaxDeleteTheme() function to prevent arbitrary file deletion and remote code execution. As a temporary workaround, consider disabling the ajaxDeleteTheme() function until a patch is available. Restrict access to the themeNameId parameter in the AJAX request to minimize the risk of exploitation.