CVE-2026-6261 - Vulnerability Analysis

Overview

Betheme WordPress theme <= 28.4 contains an arbitrary file upload vulnerability caused by unvalidated extraction of user-controlled ZIP files in upload_icons() function, letting authenticated authors upload arbitrary files and achieve remote code execution.

Severity & Score

Impact

Authenticated authors can upload arbitrary files, including PHP, leading to remote code execution and full server compromise.

Mitigation

Update to the latest version beyond 28.4.

References

• https://support.muffingroup.com/changelog/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/722c04c3-8f74-4081-b3a4-cb1ae2027312?source=cve

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner