Exploitation ongoing with high activity in latest observed window (1 mentions)
Recommended action window: Immediate (within 24h)
NVD description
The Betheme theme for WordPress is vulnerable to Arbitrary File Upload in versions up to, and including, 28.4. This is due to the upload_icons() function workflow moving and unzipping user-controlled ZIP files into a public uploads directory without validating extracted file types. This makes it possible for authenticated attackers, with author-level access and above, to upload arbitrary files (including PHP) and achieve remote code execution via the Icons icon-pack upload flow.
Priority
LOW
Exploitation
ACTIVE
PoC
NONE
Patch
NONE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-05-05 | 2 | Disclosure2 |
| 2026-05-20 | 1 | Active Exploitation1 |
CVE-2026-6261 The Betheme theme for WordPress is vulnerable to Arbitrary File Upload in versions up to, and including, 28.4. This is due to the upload_icons() function workflow movin… https://www.cve.org/CVERecord?id=CVE-2026-6261
Post summary
The Betheme WordPress theme (versions up to 28.4) is disclosed to have an arbitrary file upload flaw; no PoC, exploit, patch, or active exploitation details are provided.
A lot of offensive activities were identified targeting MuffinGroup Betheme Plugin (CVE-2026-6261) https://vuldb.com/vuln/361146/cti
Post summary
The message reports that many offensive activities targeting the MuffinGroup Betheme Plugin (CVE-2026-6261) have been observed, indicating active exploitation, but it lacks detail on PoC, exploitation code, patch, or technical specifics.
CVE-2026-6261 Arbitrary File Upload and Remote Code Execution in Betheme WordPress Theme 28.4 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-6261
Post summary
The post announces CVE-2026-6261, highlighting an arbitrary file upload that enables remote code execution in Betheme WordPress Theme 28.4, with no PoC, exploit, or mitigation details provided.