The KALLYAS - Creative eCommerce Multi-Purpose WordPress Theme contains a path traversal vulnerability (CWE-22) in the delete_font() function. This flaw allows authenticated attackers with Contributor or higher privileges to bypass file path restrictions and delete arbitrary directories on the server. The vulnerability affects all versions up to and including 4.21.0. The CVSS 3.1 base score is 8.1, reflecting network attack vector, low attack complexity, required privileges at the contributor level, no user interaction, unchanged scope, no confidentiality impact, but high integrity and availability impacts.

An attacker with Contributor-level access can delete arbitrary folders on the server, potentially disrupting website functionality and causing data loss. The vulnerability does not impact confidentiality but severely affects integrity and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Contributor-level access to trusted users only and monitor for suspicious activity related to file deletions. Avoid granting Contributor or higher privileges to untrusted users.