The vulnerability resides in the akd_required_plugin_callback function of the Eleganzo theme and stems from insufficient path validation. An authenticated user with at least Subscriber level can provide a directory path that bypasses checks and triggers deletion of arbitrary directories on the server, including the WordPress root. This flaw is a path traversal issue (CWE‑22) that can lead to loss of data, site downtime, and potentially full server compromise if the attacker deletes critical files.

WordPress installations that use the Eleganzo theme by DesigningMedia, specifically all releases up to and including version 1.2. No other versions or vendors are affected per the current vendor list.

The CVSS score of 6.5 indicates a medium severity assessment. Exploit probability metrics are not available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector requires authentication; an attacker with Subscriber or higher access can trigger the deletion via the theme’s administrative interface. Once invoked, the deletion is unconditional, granting the attacker the ability to remove any directory accessible to the web server process, which can result in site defacement, data loss, or further privilege escalation if additional vulnerabilities exist.