An attacker who is authenticated as a Subscriber or higher on a WordPress site can exploit the Game Users Share Buttons plugin by sending a crafted AJAX request to the ajaxDeleteTheme() endpoint. The plugin does not validate the themeNameId parameter, so the attacker can supply arbitrary relative paths such as ../../../../wp-config.php. This path traversal allows the attacker to delete arbitrary files on the server, including critical configuration files that can lead to remote code execution. The weakness is classified as CWE‑22.

WordPress installations that have the Game Users Share Buttons plugin version 1.3.0 or earlier are affected. The vulnerability is triggered only when the plugin is active and the attacker has at least Subscriber level access. It does not impact sites that have upgraded beyond 1.3.0 or have disabled the plugin.

The CVSS score of 8.8 indicates high severity, and the EPSS score of 3% suggests a moderate likelihood of exploitation in the current threat landscape. The vulnerability is not listed in the CISA KEV catalog. An attacker must be logged in with Subscriber privileges and must be able to invoke the ajaxDeleteTheme() action, typically via the plugin’s admin interface or by crafting a custom HTTP request. Successful exploitation can delete files such as wp-config.php, potentially granting the attacker remote code execution capabilities.