CVE-2026-6261: Betheme <= 28.4 - Authenticated (Author+) Arbitrary File Upload to Remote Code Execution via Icon Pack Upload
The Betheme theme for WordPress is vulnerable to Arbitrary File Upload in versions up to, and including, 28.4. This is due to the uploadicons() function workflow moving and unzipping user-controlled ZIP files into a public uploads directory without validating extracted file types. This makes it possible for authenticated attackers, with author-level access and above, to upload arbitrary files (including PHP) and achieve remote code execution via the Icons icon-pack upload flow.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-6261?
CVE-2026-6261 is considered a critical vulnerability because it allows authenticated users to upload malicious files and execute remote code.
How do I fix CVE-2026-6261?
The best way to fix CVE-2026-6261 is to update the Betheme theme to version 28.5 or later, which addresses this arbitrary file upload vulnerability.
Who is affected by CVE-2026-6261?
All installations of Betheme version 28.4 and below are affected by CVE-2026-6261, especially those allowing Author+ user roles.
What impact does CVE-2026-6261 have on my WordPress site?
CVE-2026-6261 can lead to remote code execution, allowing attackers to control your WordPress site and potentially compromise sensitive data.
What is the exploit method for CVE-2026-6261?
CVE-2026-6261 can be exploited through the upload_icons() function which improperly handles file uploads, enabling attackers to upload and execute arbitrary files.