CVE-2026-24970 HIGH

CVE-2026-24970: WordPress Energox theme <= 1.2 - Arbitrary File Deletion vulnerability

Vendor Designingmedia

Product Energox

Weakness CWE-22 · Path traversal

Published March 25, 2026

Last update April 28, 2026

View on NVD All CVEs

CVSS base score

7.7/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction None

Confidentiality None

Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

What the vulnerability does

01Description

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in designingmedia Energox energox allows Path Traversal.This issue affects Energox: from n/a through <= 1.2.

Explanation of Vulnerability in Simple Terms

02Summary

Energox versions 1.2 and earlier contain a path traversal vulnerability that allows authenticated users to cause a denial of service by accessing files outside the intended directory. The vulnerability requires low-level authentication and network access. An attacker can disrupt site availability by exhausting resources or triggering errors through malicious file requests.

What an attacker can do

03Attacker Capabilities

Cause the site to become unavailable or unresponsive by accessing restricted files.

Potential impact on your site

04Site Impact

Your site may experience downtime or performance degradation if an authenticated user exploits this flaw.

Conditions required to exploit

05Prerequisites

Attacker must have a low-level user account on the site; no user interaction required.

Key dates

06Disclosure timeline

March 25, 2026 CVE published

April 28, 2026 Record updated

External resources

07References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-24970 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/22.html AskarLabs — CWE-22 write-up Path Traversal

Related vulnerabilities