CVE-2026-6262: falha de média gravidade em MuffinGroup Betheme
Betheme <= 28.4 - Authenticated (Contributor+) Arbitrary File Deletion via 'mfn-icon-upload'
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.5epss 0.3%
The Betheme theme for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 28.4. This is due to the upload_icons() function workflow using a user-controlled upload path (`mfn-icon-upload`) in a filesystem move operation without constraining it to the uploads directory. This makes it possible for authenticated attackers, with contributor-level access and above, to move/delete arbitrary local files via path traversal.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Produtos afetados
MuffinGroup · BethemeCVEs relacionadas — MuffinGroup Betheme
No mesmo produto, das mais perigosas para as menos.
CVE-2022-3861HIGHBetheme <= 26.5.1.4 - Authenticated (Subscriber+) PHP Object InjectionEPSS 2.2%CVE-2024-2694HIGHBetheme <= 27.5.6 - Authenticated (Contributor+) PHP Object InjectionEPSS 0.6%CVE-2026-6261HIGHBetheme <= 28.4 - Authenticated (Author+) Arbitrary File Upload to Remote Code Execution via Icon Pack UploadEPSS 0.6%CVE-2024-5647MEDIUMMultiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Magnific Popups JavaScript LibraryEPSS 0.4%CVE-2026-6178MEDIUMBetheme <= 28.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon_box_2' ShortcodeEPSS 0.4%CVE-2024-5567MEDIUMBetheme | Responsive Multipurpose WordPress & WooCommerce Theme <= 27.5.5 - Authenticated (Author+) Stored Cross-Site Scripting via SVG FileEPSS 0.3%