Betheme WordPress Arbitrary File Upload RCE (CVE-2026-6261)

The Betheme theme for WordPress, in versions up to and including 28.4, is vulnerable to Arbitrary File Upload (CVE-2026-6261), as detailed by the National Vulnerability Database. The flaw resides in the upload_icons() function’s workflow. It moves and unzips user-controlled ZIP files into a public uploads directory without proper validation of the extracted file types.

This critical oversight allows authenticated attackers, specifically those with author-level access or higher, to upload arbitrary files. Critically, this includes PHP files. By exploiting the Icons icon-pack upload flow, attackers can achieve remote code execution (RCE) on affected WordPress sites. The National Vulnerability Database assigns this a CVSS score of 8.8 (HIGH).

This isn’t just a theoretical risk; it’s a direct path to full system compromise. The attacker’s calculus is simple: gain a foothold through a low-privilege account, upload a shell, and take over the site. For defenders, this means any WordPress site running the vulnerable Betheme version is a prime target, regardless of how robust other security layers might be. This vulnerability bypasses typical web application firewalls if the initial authentication is legitimate.