{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-15470", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-01-06T11:36:51.018Z", "datePublished": "2026-04-14T23:26:06.733Z", "dateUpdated": "2026-04-15T17:26:49.516Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-14T23:26:06.733Z"}, "affected": [{"vendor": "DesigningMedia", "product": "Eleganzo", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.2", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Eleganzo theme for WordPress is vulnerable to arbitrary directory deletion due to insufficient path validation in the akd_required_plugin_callback function in all versions up to, and including, 1.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary directories on the server, including the WordPress root directory."}], "title": "Eleganzo <= 1.2 - Authenticated (Subscriber+) Arbitrary Directory Deletion", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7c5d7818-e548-4d8f-b847-396d528b58cd?source=cve"}, {"url": "https://testwp.local/wp-content/themes/eleganzo/welcome.php#L96"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "cweId": "CWE-22", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "baseScore": 6.5, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Nguyen Tan Phat"}], "timeline": [{"time": "2025-12-13T00:00:00.000Z", "lang": "en", "value": "Discovered"}, {"time": "2026-04-14T11:01:50.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-15T17:26:32.868567Z", "id": "CVE-2025-15470", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-15T17:26:49.516Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-15470", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-15T17:26:32.868567Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-15T17:26:38.557Z"}}], "cna": {"title": "Eleganzo <= 1.2 - Authenticated (Subscriber+) Arbitrary Directory Deletion", "credits": [{"lang": "en", "type": "finder", "value": "Nguyen Tan Phat"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"}}], "affected": [{"vendor": "DesigningMedia", "product": "Eleganzo", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.2"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-12-13T00:00:00.000Z", "value": "Discovered"}, {"lang": "en", "time": "2026-04-14T11:01:50.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7c5d7818-e548-4d8f-b847-396d528b58cd?source=cve"}, {"url": "https://testwp.local/wp-content/themes/eleganzo/welcome.php#L96"}], "descriptions": [{"lang": "en", "value": "The Eleganzo theme for WordPress is vulnerable to arbitrary directory deletion due to insufficient path validation in the akd_required_plugin_callback function in all versions up to, and including, 1.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary directories on the server, including the WordPress root directory."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-14T23:26:06.733Z"}}}, "cveMetadata": {"cveId": "CVE-2025-15470", "state": "PUBLISHED", "dateUpdated": "2026-04-15T17:26:49.516Z", "dateReserved": "2026-01-06T11:36:51.018Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-04-14T23:26:06.733Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The Eleganzo theme for WordPress is vulnerable to arbitrary directory deletion due to insufficient path validation in the akd_required_plugin_callback function in all versions up to, and including, 1.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary directories on the server, including the WordPress root directory."}], "id": "CVE-2025-15470", "lastModified": "2026-04-22T20:23:16.350", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "security@wordfence.com", "type": "Primary"}]}, "published": "2026-04-15T04:17:20.670", "references": [{"source": "security@wordfence.com", "url": "https://testwp.local/wp-content/themes/eleganzo/welcome.php#L96"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7c5d7818-e548-4d8f-b847-396d528b58cd?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "security@wordfence.com", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,1.2]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Eleganzo", "source": "cna", "vendor": "DesigningMedia"}, "product": "eleganzo", "vendor": "designingmedia"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-15T00:20:42.818882+00:00", "value": {"mitigation_remediation": ["Upgrade the Eleganzo theme to any release newer than 1.2 that addresses the path validation flaw.", "If an immediate upgrade is not feasible, disable or restrict access to the akd_required_plugin_callback function so that only trusted administrators can trigger it.", "Enforce strict file system permissions and implement whitelisting of allowed directories to prevent the web server from deleting arbitrary folders."], "summary": {"action": "Immediate Patch", "impact": "Arbitrary Directory Deletion"}, "threat_synthesis": {"affected_systems": "WordPress installations that use the Eleganzo theme by DesigningMedia, specifically all releases up to and including version\u202f1.2. No other versions or vendors are affected per the current vendor list.", "description_and_impact": "The vulnerability resides in the akd_required_plugin_callback function of the Eleganzo theme and stems from insufficient path validation. An authenticated user with at least Subscriber level can provide a directory path that bypasses checks and triggers deletion of arbitrary directories on the server, including the WordPress root. This flaw is a path traversal issue (CWE\u201122) that can lead to loss of data, site downtime, and potentially full server compromise if the attacker deletes critical files.", "risk_and_exploitability": "The CVSS score of 6.5 indicates a medium severity assessment. Exploit probability metrics are not available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector requires authentication; an attacker with Subscriber or higher access can trigger the deletion via the theme\u2019s administrative interface. Once invoked, the deletion is unconditional, granting the attacker the ability to remove any directory accessible to the web server process, which can result in site defacement, data loss, or further privilege escalation if additional vulnerabilities exist."}}}}, "created": "2026-04-15T14:28:41.084633+00:00", "updated": "2026-04-15T14:53:38.962583+00:00", "vendors": ["designingmedia", "designingmedia$PRODUCT$eleganzo", "wordpress", "wordpress$PRODUCT$wordpress"]}