CVE-2025-4946: 
WordPress vulnerability analysis and mitigation

The Vikinger theme for WordPress contains a critical vulnerability (CVE-2025-4946) discovered in all versions up to and including 1.9.32. The vulnerability stems from insufficient file path validation in the vikingerdeleteactivitymediaajax() function. This security flaw was reported by Wordfence and publicly disclosed on July 2, 2025 (NVD Database, CVE Database).

The vulnerability is classified as a path traversal issue (CWE-22) with a CVSS v3.1 base score of 8.1 (HIGH), using the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H. The flaw exists in the vikingerdeleteactivitymediaajax() function, which fails to properly validate file paths. For the vulnerability to be exploitable, the Vikinger Media plugin must be installed and active (NVD Database).

The vulnerability allows authenticated attackers with Subscriber-level access or higher to delete arbitrary files on the server. This capability can lead to remote code execution when critical files such as wp-config.php are targeted for deletion (NVD Database).

Users should upgrade to a version newer than 1.9.32 when available. No specific workarounds have been publicly documented (NVD Database).