The Eleganzo WordPress theme contains a CWE-22 path traversal vulnerability in the akd_required_plugin_callback function. This flaw permits authenticated attackers with low privileges (Subscriber-level and above) to perform arbitrary directory deletion on the server. The vulnerability arises from improper limitation of pathnames to restricted directories, enabling deletion beyond intended scope, including the WordPress root directory. It affects all versions up to 1.2. The CVSS 3.1 base score is 6.5, reflecting medium severity with network attack vector, low attack complexity, and privileges required but no user interaction needed. No patch or official remediation guidance is currently available.

An attacker with Subscriber-level access or higher can delete arbitrary directories on the server hosting the WordPress site using the Eleganzo theme. This can lead to loss of critical files, including the WordPress root directory, potentially disrupting website functionality and requiring restoration from backups. The vulnerability does not directly impact confidentiality or availability but has a high impact on integrity due to unauthorized deletion of files.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user roles to trusted individuals only and monitor for suspicious activity related to directory deletions. Avoid granting Subscriber-level or higher access to untrusted users. Consider disabling or replacing the Eleganzo theme if possible.