WordPress Instant VA Theme Path Traversal Vulnerability Allowing Arbitrary File Deletion

A path traversal vulnerability has been identified in the WordPress Instant VA theme, specifically in versions through 1.0.1. This vulnerability allows for improper limitation of a pathname, potentially leading to arbitrary file deletion on the affected website.

Impact

Exploitation of this vulnerability could result in the deletion of arbitrary files from the website, including core files, which could disrupt the site's functionality.

Remediation

Users are advised to update the WordPress Instant VA theme to version 1.0.2 or later. Patchstack has also issued a mitigation rule to block attacks until the update is applied.