CVE-2025-60730 identifies an arbitrary file deletion vulnerability in PerfreeBlog v4.0.11 within the unInstallTheme function. This vulnerability allows remote attackers to delete files without authentication, leading to high confidentiality impact, partial integrity compromise, and partial availability disruption. The CVSS score of 7.6 reflects the network attack vector, low attack complexity, no privileges required, user interaction needed, and significant confidentiality impact. No patch or remediation information is currently available.

Successful exploitation can result in arbitrary deletion of files, which may lead to loss of sensitive data (high confidentiality impact), partial alteration or destruction of data (low integrity impact), and partial disruption of service (low availability impact). This could affect the stability and security of the affected PerfreeBlog installation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution when uninstalling themes and restrict access to the unInstallTheme functionality to trusted users only. Monitoring for unusual file deletions related to theme uninstallation is recommended.