Kallyas WordPress Theme Arbitrary Folder Deletion Vulnerability

A vulnerability allowing authenticated users with Contributor-level access and above to delete arbitrary folders on the server has been identified in the Kallyas theme for WordPress. This issue arises from inadequate file path validation in the delete_font() function, affecting all versions through 4.21.0.

Impact

Exploitation of this vulnerability could lead to unauthorized deletion of folders on the server, potentially causing loss of data or disruption of service.

Remediation

Users are advised to update to version 4.22.0 or a newer patched version.