The Goza - Nonprofit Charity WordPress Theme includes a function that processes plugin installation requests but fails to validate user privileges. This missing capability check allows an attacker who is not logged in to upload an arbitrary zip file. If the zip contains a webshell or other executable code, the attacker can gain remote code execution on the underlying WordPress server. The primary weakness corresponds to CWE-862, an authorization failure that permits unauthorized access to privileged operations.

Any installation of Bearsthemes Goza - Nonprofit Charity WordPress Theme version 3.2.2 or earlier is affected. The vulnerability is present in all releases up to and including 3.2.2 of this theme, which is distributed through ThemeForest and used by WordPress sites that import plugin packs.

The CVSS score of 9.8 indicates a critical severity, while the EPSS score of less than 1% suggests a very low probability of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack requires only unauthenticated access to the WordPress site with the vulnerable theme enabled, and the sole prerequisite is the ability to visit the import plugin endpoint, which is typically publicly reachable. Successful exploitation results in full remote code execution on the WordPress host.