AivahThemes Hostme Path Traversal Vulnerability Allowing Arbitrary File Deletion

A path traversal vulnerability has been identified in the AivahThemes Hostme WordPress theme, specifically in version 2, through version 7.0. This vulnerability allows unauthorized users to traverse the file system and potentially delete arbitrary files from the server. Such file deletion could disrupt the functionality of the website, especially if core files are removed.

Impact

Exploitation of this vulnerability could lead to unauthorized deletion of files from the website, with the potential to disrupt site functionality by removing essential core files.

Remediation

Users are advised to update to a version of the Hostme theme that is greater than 7.0. For those using Patchstack, a mitigation rule has been issued to block attacks targeting this vulnerability.