CVE-2025-7778: 
WordPress vulnerability analysis and mitigation

The Icons Factory plugin for WordPress (versions up to 1.6.12) contains an Arbitrary File Deletion vulnerability identified as CVE-2025-7778. This vulnerability was discovered and disclosed on August 15, 2025. The issue stems from insufficient authorization and improper path validation within the delete_files() function, allowing unauthenticated attackers to delete arbitrary files on the server (NVD).

The vulnerability exists in the delete_files() function located at line 1330 of the icons-factory.php file. It has been assigned a CVSS v3.1 Base Score of 9.8 (CRITICAL) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating network accessibility, low attack complexity, and no required privileges or user interaction. The weakness has been categorized as CWE-285 (Improper Authorization) (NVD, Wordfence).

The vulnerability allows unauthenticated attackers to delete arbitrary files on the server. This can lead to remote code execution when critical files such as wp-config.php are deleted. The potential impact is severe as it could result in complete system compromise (NVD).

The WordPress.org plugin repository has temporarily closed the Icons Factory plugin as of August 14, 2025, pending a full security review. Users are advised to remove the plugin until a patched version is available (WordPress Plugin).