The theme contains an insufficient file path validation flaw in the delete_post_photo() and add_car() functions. An authenticated attacker who has Subscriber-level access or higher can supply arbitrary file paths, causing the server to delete any file or read its contents. Because key configuration files such as wp-config.php can be removed, this flaw can lead to remote code execution. The weakness corresponds to path traversal and unauthorized file manipulation.

Affected products are the Car Dealer Automotive WordPress Theme – Responsive from ThemeMakers. All released versions up to and including 1.6.3 are vulnerable. No other versions or vendor products are currently reported as affected.

The CVSS score of 8.8 indicates a high severity vulnerability, and an EPSS score of 4% shows a non‑trivial likelihood of exploitation under current threat conditions. The vulnerability is not listed in the CISA KEV catalog. Attackers must be authenticated and hold at least Subscriber privileges; they can then invoke the delete_post_photo() or add_car() endpoints, providing a crafted file path, to delete or read files on the server. If a critical file such as wp-config.php is removed, arbitrary code execution can follow through subsequent application behavior.