The Betheme WordPress theme contains a CWE-22 path traversal vulnerability in its upload_icons() function. This function uses a user-supplied upload path parameter ('mfn-icon-upload') in a filesystem move operation without properly restricting the path to the designated uploads directory. As a result, authenticated users with contributor-level permissions or higher can manipulate the path to delete arbitrary files on the local filesystem. This vulnerability affects all versions up to and including 28.4. The CVSS 3.1 base score is 6.5, reflecting a network attack vector with low attack complexity, requiring privileges, no user interaction, and causing integrity impact without availability or confidentiality impact. No patch or official remediation has been published by MuffinGroup as of the data provided.

An attacker with contributor-level or higher access can delete arbitrary files on the server hosting the Betheme WordPress site. This compromises the integrity of the system by allowing unauthorized file deletion. There is no direct confidentiality or availability impact described. Exploitation requires authenticated access, limiting the attack surface to users with some level of trust on the site.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level access carefully and monitor for suspicious activity related to file operations. Avoid granting contributor or higher privileges to untrusted users. Consider disabling or restricting the vulnerable functionality if possible.