CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
What the vulnerability does
The Kallyas theme for WordPress is vulnerable to arbitrary folder deletion due to insufficient file path validation in the delete_font() function in all versions up to, and including, 4.21.0. This makes it possible for authenticated attackers, with Contributor-level access and above, to delete arbitrary folders on the server.
Explanation of Vulnerability in Simple Terms
The KALLYAS WordPress theme versions up to 4.21.0 contain a path traversal vulnerability that allows authenticated users to read, modify, or delete arbitrary files on the server. An attacker with low-level site access can bypass file system restrictions and access sensitive data outside the intended directories. This affects file integrity and availability on affected sites.
What an attacker can do
Read, modify, or delete arbitrary files on the server outside the intended directories.
Potential impact on your site
Attackers with contributor or subscriber access can compromise site files, steal configuration data, or disable the site.
Conditions required to exploit
Attacker must have a low-privilege authenticated account on the WordPress site.
Key dates
External resources
Related vulnerabilities
