Improper Limitation of a Pathname to a Restricted Directory allows a path traversal condition that can lead to arbitrary deletion of files within the WordPress installation. The vulnerability permits a malicious actor to specify a file path that escapes the intended directory boundary, causing the Scape theme code to delete the target file. This can compromise site integrity, remove critical content or configuration files, and result in a denial of service. The weakness is catalogued as CWE-22.

Whitebox-Studio Scape theme distributed as part of WordPress sites. All installations of the Scape theme with versions prior to 1.5.16 are affected. No additional vendor or product scope is identified beyond the theme itself.

The CVSS base score of 8.6 indicates a high severity vulnerability. EPSS indicates a low probability of widespread exploitation, and the issue is not listed in CISA’s KEV catalog, suggesting it has not been actively exploited in the wild. The likely attack vector is remote, achieved via HTTP requests to the WordPress site that invoke the vulnerable theme functionality. Exploitation would require successful path traversal and file deletion, though authentication requirements are not specified in the available description. Given these factors, the overall risk remains high but exploitation effort is likely low to moderate.