High · 7.4 CVE-2025-46439 EUVD-2025-12062GHSA-x6pm-2q7g-w2jv

WordPress Plugin Central plugin <= 2.5.1 - CSRF to Arbitrary File Deletion vulnerability

Published Apr 24, 2025 · Updated Apr 28, 2026 · Assigned by Patchstack

Vendor: Vladimir Prelovac Product: Plugin Central Category: Web / CMS

Description

Cross-Site Request Forgery (CSRF) vulnerability in Vladimir Prelovac Plugin Central plugin-central allows Path Traversal.This issue affects Plugin Central: from n/a through <= 2.5.1.

Affected products

Vendor	Product	Affected	Fixed
Vladimir Prelovac	Plugin Central	≤ 2.5.1	—

References

https://patchstack.com/database/Wordpress/Plugin/plugin-central/vulnerability/wordpress-plugin-central-plugin-2-5-1-csrf-to-arbitrary-file-deletion-vulnerability?_s_id=cve vdb-entry