Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The Betheme theme for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 28.4. This is due to the upload_icons() function workflow using a user-controlled upload path (`mfn-icon-upload`) in a filesystem move operation without constraining it to the uploads directory. This makes it possible for authenticated attackers, with contributor-level access and above, to move/delete arbitrary local files via path traversal.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-6262 The Betheme theme for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 28.4. This is due to the upload_icons() function workflow usi… https://www.cve.org/CVERecord?id=CVE-2026-6262
Post summary
The Betheme WordPress theme versions up to 28.4 allow arbitrary file deletion through the upload_icons() function, as detailed in CVE‑2026‑6262.
CVE-2026-6262 Arbitrary File Deletion in Betheme WordPress Theme Versions Up to ... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-6262 Vulnerability Alert Subscriptions: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=1
Post summary
The post alerts about CVE-2026-6262, indicating it permits arbitrary file deletion in Betheme WordPress Theme, and directs readers to a reference page for more information.