Critical · published August 15, 2025
🚨 A simple request can lead to a devastating mess! The Icons Factory plugin for WordPress allows unauthenticated users to delete any file on the server, like giving a complete stranger the keys to your server's storage! 🔥 Think of it as a restaurant where anyone can walk in and remove items from the kitchen — a recipe book, a main ingredient, or even the chef’s secret notes! If they take the wrong item, it can shut down the whole operation. An attacker could delete critical files like wp-config.php, effectively giving them the power to take over your WordPress site. This could lead to a full remote code execution scenario, compromising your entire server and its data. The implications are absolutely devastating!
Think of it as a restaurant where anyone can walk in and remove items from the kitchen — a recipe book, a main ingredient, or even the chef’s secret notes! If they take the wrong item, it can shut down the whole operation. This vulnerability stems from insufficient authorization and improper path validation in the delete_files() function of the Icons Factory plugin, affecting all versions up to and including 1.6.12.
An attacker could delete critical files like wp-config.php, effectively giving them the power to take over your WordPress site. This could lead to a full remote code execution scenario, compromising your entire server and its data. The implications are absolutely devastating! To protect your site, patch the plugin immediately to version 1.6.13 or higher. Additionally, review your file permissions and consider restricting file deletion capabilities to authorized users only. Don't wait until it's too late! You've got this! Follow these steps, and you'll help keep your WordPress site safe and sound! 🛡️