Introduction
Deleting the wrong file on a WordPress server can instantly hand an attacker control of the entire site. CVE-2025-7778 makes that possible on any site running the Icons Factory plugin up to and including version 1.6.12. Critical flaws in the plugin's file management logic let unauthenticated users delete arbitrary files on the server.
Icons Factory is a WordPress plugin that adds icon management for site administrators and designers. It is not among the most widely used WordPress plugins, but it has a niche among users who want simpler icon integration. Like many WordPress plugins, it is developed and maintained by a small team, and that can sometimes lead to gaps in security practices.
Technical Information
CVE-2025-7778 comes from two main issues in the delete_files() function of the Icons Factory plugin:
- Insufficient authorization: The function does not check whether the user making the request is allowed to delete files, so any unauthenticated user can trigger file deletions.
- Improper path validation: The function does not properly sanitize or restrict the file paths the user provides. Attackers can use directory traversal sequences (such as
../) to target files outside the intended directory.
The vulnerable code is at line 1330 of the main plugin file (reference). The exact code is not reproduced here, but public sources confirm that the function processes user-supplied file paths without adequate checks. An attacker can therefore craft a request that specifies any file path accessible to the web server process, including critical files like wp-config.php.
The most severe case is deleting wp-config.php, which holds the WordPress configuration and database credentials. Once that file is gone, WordPress starts its installation routine, and the attacker can use it to create a new administrator account and take full control of the site.
Affected Systems and Versions
- Product: Icons Factory WordPress plugin
- Affected versions: All versions up to and including 1.6.12
- Vulnerable configuration: Any WordPress site with the plugin installed and active at these versions
Vendor Security History
Icons Factory has no public record of previous vulnerabilities. Arbitrary file deletion flaws have been reported in other WordPress plugins, though, which points to a recurring issue in the ecosystem. Public sources do not document the vendor's response time or patching history for this plugin.
