The Vikinger theme contains an insufficient file path validation flaw in the vikinger_delete_activity_media_ajax() function that allows authenticated users with Subscriber level or higher to delete any file located on the server. An attacker can delete critical files such as wp-config.php, which can immediately lead to remote code execution or complete site compromise. The vulnerability is conditioned on the presence of the Vikinger Media plugin and requires the user to have the appropriate WordPress role.

Vendors and products affected are Odin Design's Vikinger theme for WordPress. All released versions up to and including 1.9.32 are susceptible. The issue manifests when the theme is used on any WordPress installation that has the Vikinger Media plugin installed and active.

The CVSS score of 8.1 indicates a high severity vulnerability that can be exploited remotely. The EPSS score of 2% suggests that at present the likelihood of exploitation in the wild is low but non‑negligible. Because the attack requires only a logged‑in user with Subscriber or greater privileges, the barrier to entry is low for site owners. The vulnerability does not appear in the CISA KEV catalog, but if exploited it can result in file deletion, site downtime, and potential remote code execution. Attackers would typically trigger the misconfigured AJAX endpoint to perform the deletion.