Betheme WordPress Theme Arbitrary File Deletion Vulnerability

A vulnerability allowing arbitrary file deletion has been identified in the Betheme WordPress theme, affecting versions through 28.4. The issue arises from the upload_icons() function, which uses a user-controlled upload path in a file move operation without restricting it to the uploads directory. This flaw enables authenticated attackers with contributor-level access and above to delete or move arbitrary local files using path traversal techniques.

Impact

Exploitation of this vulnerability could lead to unauthorized deletion of files on the server, potentially causing data loss or disruption of service.

Remediation

Users are advised to update to Betheme version 28.4.1 or a newer patched version.