Game Users Share Button
Approved changes feed: RSS · Atom
cpe:2.3:a:gameusers:game_users_share_button:*:*:*:*:*:wordpress:*:*
part: a version: * update: *
| Vendor | Gameusers (8ab7898a-d460-5d59-8da4-557d0fccab0a) |
|---|---|
| Product | Game Users Share Button (f60f7646-0490-595b-95a5-17c666078b37) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | wordpress |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-6755 |
vulnerable | 2026-06-08 07:43:16.193978 |
Game Users Share Buttons <= 1.3.0 - Authenticated (Subscriber+) Arbitrary File Deletion via themeNameId Parameter
HIGH (8.8)
The Game Users Share Buttons plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the ajaxDeleteTheme() function in all versions up to, and including, 1.3.0. This makes it possible for Subscriber-level attackers to add arbitrary file paths (such as ../../../../wp-config.php) to the themeNameId parameter of the AJAX request, which can lead to remote code execution.
Published: 2025-06-28T05:29:51.899Z
Updated: 2026-04-08T17:33:57.349Z Reference links |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.