- Description
- The Game Users Share Buttons plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the ajaxDeleteTheme() function in all versions up to, and including, 1.3.0. This makes it possible for Subscriber-level attackers to add arbitrary file paths (such as ../../../../wp-config.php) to the themeNameId parameter of the AJAX request, which can lead to remote code execution.
- Source
- security@wordfence.com
- NVD status
- Analyzed
CVSS 3.1
- Type
- Primary
- Base score
- 8.8
- Impact score
- 5.9
- Exploitability score
- 2.8
- Vector string
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Severity
- HIGH
- security@wordfence.com
- CWE-22
- Hype score
- Not currently trending
CVE-2025-6755 The Game Users Share Buttons plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the ajaxDeleteTheme() function in… https://t.co/hMv1VPj3M8
@CVEnew
28 Jun 2025
556 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
[CVE-2025-6755: HIGH] WordPress plugin Game Users Share Buttons has a critical security flaw allowing attackers to delete files and execute remote code. Users with Subscriber access are at risk.#cve,CVE-2025-6755,#cybersecurity https://t.co/kM7FJL9THW https://t.co/qwfe06qO9s
@CveFindCom
28 Jun 2025
66 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
[
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:gameusers:game_users_share_button:*:*:*:*:*:wordpress:*:*",
"vulnerable": true,
"matchCriteriaId": "D4E30632-DD6C-48CB-AFBE-14F67465BC7A",
"versionEndIncluding": "1.3.0"
}
],
"operator": "OR"
}
]
}
]