The WPLMS Learning Management System for WordPress theme suffers from CWE-22: improper limitation of a pathname to a restricted directory. Specifically, the readfile and unlink functions do not properly validate file paths or check permissions, enabling unauthenticated attackers to arbitrarily read and delete files on the server. This vulnerability affects all versions up to 4.962 and is exploitable regardless of whether the theme is activated. The deletion of critical files such as wp-config.php can result in remote code execution. The CVSS 3.1 score is 9.8, indicating a critical severity with network attack vector, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability.

An unauthenticated attacker can delete arbitrary files on the server hosting the vulnerable WordPress theme. This can lead to remote code execution if key files like wp-config.php are deleted, severely compromising the affected system's confidentiality, integrity, and availability. The vulnerability exists even if the theme is not activated, increasing the attack surface.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected WordPress installation and consider disabling or removing the vulnerable theme if possible. Monitor vendor channels for updates and apply patches promptly once available.