Critical · published September 9, 2025
🚨 An unauthenticated attacker could delete any file on your server using just one flaw in the Goza WordPress theme! 🔥 Think of it like a careless librarian who misfiled the key to the archive room — with just a little elbow grease, an intruder can delete the library's most precious books. Once the wrong files are gone, they can even rewrite the entire library’s catalog! This vulnerability could open the floodgates for chaos, allowing an attacker to obliterate crucial files like wp-config.php. This means your entire site could come crashing down, or worse, the attacker could execute code on your server — a recipe for absolute disaster.
Think of it like a careless librarian who misfiled the key to the archive room — with just a little elbow grease, an intruder can delete the library's most precious books. Once the wrong files are gone, they can even rewrite the entire library’s catalog! The Goza WordPress theme is vulnerable to arbitrary file deletion due to a mistake in the alone_import_pack_restore_data() function, not properly validating file paths. This oversight allows unauthenticated users to delete any file they target.
This vulnerability could open the floodgates for chaos, allowing an attacker to obliterate crucial files like wp-config.php. This means your entire site could come crashing down, or worse, the attacker could execute code on your server — a recipe for absolute disaster. Immediately upgrade to version 3.2.3 of the Goza theme to patch this vulnerability. Additionally, review file permissions and ensure that only authorized users have access to critical files. Regularly audit your server for additional security enhancements. You’ve got this! Secure your site by following these steps and you’ll be back in the driver’s seat in no time! 🛡️