CVE-2025-5014

Name of the Vulnerable Software and Affected Versions: The Home Villas | Real Estate WordPress Theme versions up to, and including, 2.8

Description: The issue is related to insufficient file path validation in the wp rem cs widget file delete function, allowing authenticated attackers with Subscriber-level access and above to delete arbitrary files on the server. This can lead to remote code execution when specific files, such as wp-config.php, are deleted.

Recommendations: For versions up to, and including, 2.8, consider disabling the wp rem cs widget file delete function until a patch is available to prevent arbitrary file deletion. Restrict access to sensitive files on the server to minimize the risk of exploitation.