Betheme for WordPress allows authenticated users with author level or higher to upload ZIP files containing any file types. The upload_icons() workflow extracts the zip into a publicly accessible uploads directory without validating the file extensions. An attacker can therefore upload a PHP script and subsequently trigger its execution on the server, achieving remote code execution.

Any WordPress site using MuffinGroup’s Betheme theme up to and including version 28.4 is affected. The vulnerability is triggered by the icon‑pack upload functionality and requires that the attacker holds author‑level or higher privileges.

The CVSS score of 8.8 indicates a high severity attack. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, so public exploitation data is limited. However, the attack path is clear: an authenticated author+ can upload a PHP payload via the icon‑pack flow and execute it, giving full control over the affected WordPress installation. The lack of file‑type validation is the core weakness (CWE‑434).