The Kallyas WordPress theme contains a flaw in the delete_font() function that allows authenticated users with Contributor-level permissions and higher to delete arbitrary folders on the server. This vulnerability arises from insufficient file path validation, enabling an attacker to specify unrestricted folder paths. The resulting impact is loss of files or directories, potentially compromising website functionality or data integrity.

The flaw affects hogash's KALLYAS Creative eCommerce Multi‑Purpose WordPress Theme versions up to and including 4.21.0.

The CVSS v3 score of 8.1 indicates high severity. The EPSS score is less than 1 %, suggesting low overall exploitation probability, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is an authenticated user with Contributor or higher privileges. Successful exploitation requires the attacker to first authenticate to the WordPress site, after which the delete_font() endpoint can be invoked with a crafted path to remove any folder on the server. Because the attack is authenticated, sites that do not grant Contributor permissions are not exposed, but any site that does is at risk.