Home Villas Real Estate WordPress Theme Arbitrary File Deletion Vulnerability

A vulnerability allowing arbitrary file deletion has been identified in the Home Villas | Real Estate WordPress Theme, affecting all versions through 2.8. This issue arises from inadequate validation of file paths in the 'wp_rem_cs_widget_file_delete' function. As a result, authenticated attackers with Subscriber-level access or higher can delete arbitrary files from the server. This vulnerability could easily lead to remote code execution if a critical file, such as wp-config.php, is deleted.

Impact

Exploitation of this vulnerability could result in unauthorized deletion of files on the server, potentially leading to remote code execution if a sensitive file is removed.

Remediation

No known patch is available. It is recommended to review the vulnerability details and consider uninstalling the affected theme.