CVE-2025-68901CWE-22

WordPress Anona theme <= 8.0 - Arbitrary File Deletion vulnerability

High · published January 22, 2026

CVSS v3.1
8.6
EPSS
1%
Percentile
42.5
In the wild
Unconfirmed
What it is

⚡ A sneaky path traversal vulnerability lurks in AivahThemes Anona, letting attackers access files they shouldn’t! Think of this like a delivery driver who follows a poorly marked route and ends up at your backyard instead of your front door — they can access anything lying around. This flaw allows unauthorized file access, bypassing intended barriers like a wayward courier ignoring signs. An attacker could potentially access sensitive files on the server, exposing user data or even application secrets. This could lead to devastating information leaks or other exploitable vulnerabilities if they find the right files—yikes!

Put simply

Think of this like a delivery driver who follows a poorly marked route and ends up at your backyard instead of your front door — they can access anything lying around. This flaw allows unauthorized file access, bypassing intended barriers like a wayward courier ignoring signs. This path traversal vulnerability allows attackers to manipulate file paths, gaining unauthorized access to files outside the intended directories in Anona versions up to 8.0.

What to do

An attacker could potentially access sensitive files on the server, exposing user data or even application secrets. This could lead to devastating information leaks or other exploitable vulnerabilities if they find the right files—yikes! Update AivahThemes Anona to the latest version immediately to close this vulnerability. Review file access permissions to ensure sensitive files are protected, and implement proper input validation to mitigate path traversal risks. 🛡️ You've got this! With a quick update and a little vigilance, you'll keep your system secure and sound. 🚀

The record
Technical detail
CVSS v3.1
8.6 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00508 · 42.5th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-01-22T16:52Z
EPSS history
Timeline
  • 22 JAN 16:52Z
    WordPress Anona theme <= 8.0 - Arbitrary File Deletion vulnerability
    cvelistv5