What is the CVSS score of CVE-2026-6262?

CVE-2026-6262 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.0%.

Betheme WordPress Theme CVE-2026-6262

EUVD-2026-27303 MEDIUM

Path Traversal (CWE-22)

2026-05-05 Wordfence

WordPress Path Traversal

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

May 05, 2026 - 12:21 vuln.today

DescriptionCVE.org

The Betheme theme for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 28.4. This is due to the upload_icons() function workflow using a user-controlled upload path (mfn-icon-upload) in a filesystem move operation without constraining it to the uploads directory. This makes it possible for authenticated attackers, with contributor-level access and above, to move/delete arbitrary local files via path traversal.

AnalysisAI

Arbitrary file deletion via path traversal in Betheme WordPress theme version 28.4 and earlier allows authenticated contributors and above to delete arbitrary files on the server by manipulating the mfn-icon-upload parameter in the upload_icons() function. The vulnerability requires valid WordPress account credentials at contributor level or higher but exploits an unconstrained filesystem move operation to bypass upload directory restrictions. No public exploit code or active KEV listing identified at analysis time.

Technical ContextAI

The upload_icons() function in Betheme processes user-supplied file upload paths through the mfn-icon-upload parameter. Rather than validating that uploaded files remain within WordPress's wp-content/uploads directory, the function uses this user-controlled path directly in a filesystem move or file operation, enabling path traversal attacks via directory traversal sequences (e.g., '../'). CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) describes the root cause: the application fails to neutralize path traversal components before using them in filesystem operations. The vulnerability affects Muffingroup's Betheme product (CPE: cpe:2.3:a:muffingroup:betheme:*:*:*:*:*:*:*:*) across all versions through 28.4.

RemediationAI

Update Betheme to version 29.0 or later via the WordPress theme updates interface or directly from Muffingroup's support portal at https://support.muffingroup.com/changelog/. Site administrators should immediately review and audit WordPress user accounts with contributor access or higher, removing unnecessary elevated privileges and disabling unused accounts. Wordfence threat intelligence reference at https://www.wordfence.com/threat-intel/vulnerabilities/id/3486f114-5625-4751-a25e-2c5ab7b15b38 provides additional detail. As a temporary workaround pending updates, restrict the 'mfn-icon-upload' functionality by disabling the icon upload feature in Betheme settings if not actively used, or apply a Web Application Firewall (WAF) rule to block POST/GET requests containing '../' sequences to the upload handler. Note that disabling icon uploads may affect theme customization capabilities.