CVE-2026-31913 HIGH

CVE-2026-31913: WordPress Scape theme < 1.5.16 - Arbitrary File Deletion vulnerability

Vendor Whitebox-Studio

Product Scape

Weakness CWE-22 · Path traversal

Published March 25, 2026

Last update April 29, 2026

View on NVD All CVEs

CVSS base score

8.6/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality None

Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

What the vulnerability does

01Description

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Whitebox-Studio Scape scape allows Path Traversal.This issue affects Scape: from n/a through < 1.5.16.

Explanation of Vulnerability in Simple Terms

02Summary

Scape versions before 1.5.16 contain a path traversal vulnerability that allows an attacker to cause a denial of service by making the application unavailable. The vulnerability requires no authentication or user interaction and can be exploited over the network. The impact extends beyond the vulnerable component itself.

What an attacker can do

03Attacker Capabilities

Make the application unavailable or unresponsive by exploiting a path traversal flaw.

Potential impact on your site

04Site Impact

Your Scape installation could become unavailable or unresponsive without warning or user action.

Conditions required to exploit

05Prerequisites

Network access to the application. No authentication or user interaction required.

Key dates

06Disclosure timeline

March 25, 2026 CVE published

April 29, 2026 Record updated

External resources

07References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-31913 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/22.html AskarLabs — CWE-22 write-up Path Traversal

Related vulnerabilities