The Betheme WordPress theme versions up to and including 28.4 contain an arbitrary file upload vulnerability. This flaw arises from the upload_icons() function, which moves and unzips user-supplied ZIP files into a public uploads directory without validating the extracted file types. Authenticated users with author-level access or higher can exploit this to upload arbitrary files, including PHP scripts, potentially leading to remote code execution.