An attacker with Subscriber or higher privileges on a WordPress site can exploit the Game Users Share Buttons plugin by sending malicious AJAX requests to the ajaxDeleteTheme() endpoint. The plugin fails to validate the themeNameId parameter correctly, allowing the attacker to specify relative paths such as ../../../../wp-config.php. This flaw leads to arbitrary file deletion, which can in turn remove critical configuration files and enable remote code execution or deny‑of‑service conditions. The weakness is a classic path traversal vulnerability classified as CWE‑22.

Any WordPress installation running Game Users Share Buttons versions 1.3.0 or earlier is affected. The vulnerability is triggered by authenticated users who have Subscriber level access or higher, and is only present when the plugin is active.

The CVSS score of 8.8 indicates a high severity, while the EPSS score of 1% suggests a moderate probability of exploitation in the current market. The vulnerability is not listed in the CISA KEV catalog. An attacker must be logged in with at least Subscriber privileges and must be able to invoke the ajaxDeleteTheme() action, typically via the plugin’s admin interface or by crafting a custom HTTP request. Successful exploitation can delete configuration files such as wp-config.php, potentially leading to full site compromise.