The vulnerability allows an unauthenticated user to delete arbitrary files from the server when using Car Zone theme version 3.7 or earlier. This flaw arises from insufficient path validation, enabling the attacker to remove any file the web server process can access, which can corrupt site data, break functionality, and deny legitimate users service. The weakness is identified as CWE‑22, a path traversal/relative path vulnerability. Evidence shows no remote code execution, but the impact on confidentiality, integrity, and availability is significant because attackers can erase critical files such as configuration, media, or theme files.

The issue affects installations of the AivahThemes Car Zone WordPress theme up to and including version 3.7. Users running any WordPress site with this theme on an unauthenticated surface are at risk until an upgrade or removal of the vulnerable theme occurs.

The CVSS score of 8.6 indicates a high severity. The EPSS score of less than 1% suggests a very low but non‑zero probability of exploitation in the wild. The vulnerability is not listed in CISA KEV, implying it is not a known exploited vulnerability at the time of this analysis. The attack vector is not explicitly specified in the CVE documentation; it is inferred that unauthenticated access to the theme’s web interface could enable the deletion operation. The vulnerability can be exploited without authentication if the theme is publicly exposed, making the risk high for any public WordPress site that has not patched or removed the theme.