CVE-2025-10690

Goza - Nonprofit Charity WordPress Theme <= 3.2.2 - Missing Authorization to Unauthenticated Arbitrary File Upload via Plugin Installation

CVSS 9.8 CRITICALEPSS 0.7%CWE-862

The Goza - Nonprofit Charity WordPress Theme theme for WordPress is vulnerable to unauthorized arbitrary file uploads due to a missing capability check on the 'beplus_import_pack_install_plugin' function in all versions up to, and including, 3.2.2. This makes it possible for unauthenticated attackers to upload zip files containing webshells disguised as plugins from remote locations to achieve remote code execution.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Bearsthemes · Goza - Nonprofit Charity WordPress Theme

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://themeforest.net/item/goza-nonprofit-charity-wordpress-theme/23781575 https://www.cve.org/CVERecord?id=CVE-2025-5394 https://www.wordfence.com/threat-intel/vulnerabilities/id/628bfa19-2ffa-426b-8b88-22a0c4d0ba92?source=cve