CVE-2025-10690: 
WordPress vulnerability analysis and mitigation

CVE-2025-10690 is an unauthorized arbitrary file upload vulnerability in the Goza - Nonprofit Charity WordPress Theme for WordPress, affecting all versions up to and including 3.2.2. The flaw stems from a missing capability check on the beplus_import_pack_install_plugin function, allowing unauthenticated attackers to upload malicious zip files containing webshells disguised as plugins to achieve remote code execution. The CVE was published on September 18–19, 2025, and was reported by Wordfence. It carries a CVSS v3.1 base score of 9.8 (Critical) (Wordfence, ENISA EUVD).

The root cause is classified as CWE-862 (Missing Authorization): the beplus_import_pack_install_plugin function in the Goza theme does not perform any capability or authentication check before processing plugin installation requests. An unauthenticated remote attacker can send an HTTP request to this function, supplying a URL pointing to a remote zip archive. The theme fetches and installs the zip as a WordPress plugin without verifying the requester's identity or privileges, allowing the attacker to plant a webshell on the server and achieve remote code execution (Wordfence, ENISA EUVD).

Successful exploitation grants an unauthenticated attacker full remote code execution on the WordPress server, with the ability to read, modify, or delete any data accessible to the web server process. This includes complete compromise of confidentiality (access to database credentials, user data, and site content), integrity (defacement, backdoor installation, or supply-chain attacks via the compromised site), and availability (service disruption or ransomware deployment). The installed webshell can also serve as a persistent foothold for lateral movement within the hosting environment (Wordfence).

No public proof-of-concept exploit code has been identified at this time, and there is no confirmed evidence of active in-the-wild exploitation or threat actor attribution. The vulnerability requires no authentication, no user interaction, and no special preconditions, making it trivially exploitable by any remote attacker who can reach the WordPress installation. The EPSS score is approximately 0.206%, indicating a currently low but non-negligible probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog as of the time of this report (Wordfence, ENISA EUVD).

1. Reconnaissance: Identify WordPress sites using the Goza - Nonprofit Charity WordPress Theme (versions ≤ 3.2.2) via web fingerprinting tools (e.g., WPScan, Shodan, or Google dorks targeting theme-specific assets such as /wp-content/themes/goza/).
2. Prepare malicious payload: Create a zip archive containing a PHP webshell (e.g., a file named shell.php with <?php system($_GET['cmd']); ?>) structured as a valid WordPress plugin directory with a plugin header comment to pass basic WordPress plugin checks.
3. Host the payload: Upload the malicious zip to an attacker-controlled server accessible via HTTP/HTTPS.
4. Trigger the vulnerable function: Send an unauthenticated HTTP POST request to the WordPress site targeting the beplus_import_pack_install_plugin AJAX action (e.g., POST /wp-admin/admin-ajax.php with action=beplus_import_pack_install_plugin and a parameter pointing to the attacker's hosted zip URL). No authentication cookies or nonces are required due to the missing capability check.
5. Achieve remote code execution: Once the zip is fetched and installed as a plugin, access the webshell at its installed path (e.g., /wp-content/plugins/<plugin-name>/shell.php?cmd=id) to execute arbitrary OS commands on the server (Wordfence).

• Network: Unauthenticated POST requests to /wp-admin/admin-ajax.php with action=beplus_import_pack_install_plugin; outbound HTTP/HTTPS requests from the web server process to external IPs fetching zip archives; unusual outbound connections from the web server to attacker-controlled infrastructure.
• File System: Unexpected new directories or PHP files under /wp-content/plugins/ not corresponding to legitimate installed plugins; zip archives written to temporary directories by the web server process; PHP files with obfuscated code or system command execution patterns (system(), exec(), passthru(), shell_exec()).
• Logs: WordPress access logs showing POST requests to admin-ajax.php with the beplus_import_pack_install_plugin action from unauthenticated sessions; PHP error logs referencing plugin installation from remote URLs; web server access logs showing GET requests to newly created plugin PHP files with query parameters like cmd=.
• Process: Unusual child processes spawned by the PHP/web server process (e.g., bash, sh, curl, wget, python) executing system commands.

The primary remediation is to update the Goza - Nonprofit Charity WordPress Theme to a version beyond 3.2.2 that includes a proper capability check on the beplus_import_pack_install_plugin function. Site administrators should check the ThemeForest marketplace for an updated release (ThemeForest). As an interim workaround, consider disabling the theme's import/plugin installation functionality via a Web Application Firewall (WAF) rule blocking unauthenticated requests to admin-ajax.php with the beplus_import_pack_install_plugin action. Additionally, audit the WordPress installation for unexpected plugins or PHP files and review server logs for signs of prior exploitation.

Wordfence, the CNA that reported and assigned this CVE, published details in their weekly WordPress vulnerability report covering September 8–14, 2025 (Wordfence Blog). The vulnerability was also noted in the CISA vulnerability bulletin SB25-265 and indexed by ENISA's EUVD. No significant independent researcher commentary or broader media coverage has been identified beyond standard vulnerability aggregator reporting.