What is the CVSS score of CVE-2026-6261?

CVE-2026-6261 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Betheme WordPress theme are affected by CVE-2026-6261?

CVE-2026-6261 affects Betheme WordPress theme up to version 28.4 and allows authenticated site contributors with author-level access to execute arbitrary code by uploading malicious files through the…

How to fix or mitigate CVE-2026-6261?

Within 24 hours: Identify all WordPress installations using Betheme theme and document current installed versions via theme admin panel. Within 7 days: Restrict author-level upload permissions to trusted users only; audit contributor account access logs for suspicious activity. Within 30 days: Monitor vendor advisories for patch release (current patch status: not available); consider theme replacement or apply Web Application Firewall rules to block suspicious ZIP uploads to wp-content directories.

Betheme WordPress theme CVE-2026-6261

EUVD-2026-27301 HIGH

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-05-05 Wordfence

GHSA-xjrr-vq8h-v4xh

WordPress File Upload RCE

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 05, 2026 - 12:18 vuln.today

DescriptionCVE.org

The Betheme theme for WordPress is vulnerable to Arbitrary File Upload in versions up to, and including, 28.4. This is due to the upload_icons() function workflow moving and unzipping user-controlled ZIP files into a public uploads directory without validating extracted file types. This makes it possible for authenticated attackers, with author-level access and above, to upload arbitrary files (including PHP) and achieve remote code execution via the Icons icon-pack upload flow.

AnalysisAI

Remote code execution in Betheme WordPress theme versions up to 28.4 allows authenticated attackers with author-level privileges to upload malicious PHP files disguised as icon packs. The upload_icons() function extracts user-controlled ZIP files into public directories without validating extracted content, enabling arbitrary code execution. This vulnerability requires only author-level WordPress credentials (PR:L) and has network attack vector (AV:N) with low complexity (AC:L), making it readily exploitable by compromised or malicious site contributors. No public exploit code or CISA KEV listing identified at time of analysis.

Technical ContextAI

This vulnerability affects the Betheme theme's icon pack upload functionality, specifically the upload_icons() function workflow. The flaw is a classic CWE-434 (Unrestricted Upload of File with Dangerous Type) implementation error. The function accepts ZIP archives from authenticated users, extracts contents to the WordPress uploads directory (publicly accessible via web server), but fails to validate the MIME types or file extensions of extracted files. While the feature is intended for uploading icon font packages (typically SVG, WOFF, TTF files), the lack of post-extraction validation allows attackers to embed PHP webshells inside otherwise legitimate-appearing ZIP archives. Once extracted to the uploads directory, these PHP files become directly accessible via HTTP requests, allowing immediate code execution in the web server context. The affected product per CPE is muffingroup:betheme WordPress theme, a commercial theme framework with extensive customization features including this icon management system.

RemediationAI

Upgrade Betheme theme to version 28.5 or later if available (verify latest secure version at https://support.muffingroup.com/changelog/ - specific patched version not independently confirmed from provided data). As an immediate compensating control, restrict icon pack upload functionality to administrator-only access by modifying WordPress user role capabilities or disabling the feature entirely if not business-critical. Implement server-side MIME type validation and file extension whitelisting for all upload handlers. Deploy web application firewall rules to block direct access to PHP files in the wp-content/uploads directory (note: this may break legitimate plugin functionality - test thoroughly). For advanced deployments, configure PHP-FPM or web server to deny PHP execution in uploads directories via .htaccess or nginx configuration. Audit existing uploaded icon packs for suspicious PHP files by scanning wp-content/uploads/betheme-icons/ or similar paths. Review WordPress user accounts with author privileges and above for unauthorized access or credential compromise.