AivahThemes Anona theme through version 8.0 contains an improper limitation of a pathname to a restricted directory, allowing path traversal and the deletion of arbitrary files on the server. An attacker who can craft a request to the theme can cause the theme to delete critical configuration, media, or code files, potentially leading to loss of data, website downtime, or a platform compromise. The weakness is a classic file path traversal flaw (CWE-22).

WordPress sites that have the Anona theme installed with a version equal to or less than 8.0 are affected. No specific role or permission requirements are indicated, so the impact could be exploitable by any user able to trigger the theme’s file deletion functionality.

The CVSS score of 8.6 categorises this vulnerability as high severity. The EPSS score of less than 1% suggests that actual exploitation is currently unlikely, and the vulnerability is not yet listed in the CISA KEV catalog. Nonetheless, the flaw can be leveraged via a web request that includes a specially constructed file path; if the application does not validate or sandbox the path, the attacker can delete any file the web server can delete. Due to the lack of publicly observed exploits, the risk for most installations today is moderate but still significant given the potential impact.