CVE-2026-6261: WordPress Betheme Theme RCE Vulnerability

CVE-2026-6261 Overview

CVE-2026-6261 is an arbitrary file upload vulnerability in the Betheme theme for WordPress, affecting all versions up to and including 28.4. The flaw resides in the upload_icons() function, which moves and unzips user-supplied ZIP archives into a public uploads directory without validating the extracted file types. Authenticated users with author-level access or higher can abuse the Icons icon-pack upload workflow to drop PHP files onto the server. Successful exploitation results in remote code execution under the web server account, enabling full site compromise.

Critical Impact
Authenticated attackers with author privileges can upload arbitrary PHP files via the icon-pack ZIP handler and execute code remotely on affected WordPress installations.

Affected Products

Betheme WordPress theme by Muffin Group
All versions up to and including 28.4
WordPress sites permitting author-level (or higher) account registration

Discovery Timeline

2026-05-05 - CVE CVE-2026-6261 published to NVD
2026-05-05 - Last updated in NVD database

Technical Details for CVE-2026-6261

Vulnerability Analysis

The vulnerability is classified as Arbitrary File Upload under CWE-434. The Betheme theme exposes an icon-pack upload feature handled by the upload_icons() function. This function accepts a ZIP archive from authenticated users and extracts its contents into a publicly accessible directory inside wp-content/uploads/. The extraction step does not enforce an allowlist of file extensions or validate MIME types of files contained within the archive. As a result, an attacker can craft a ZIP that contains executable PHP files alongside legitimate icon assets and have them written to a web-accessible path.

Root Cause

The root cause is missing validation of file types after archive extraction. The handler trusts the contents of the user-supplied ZIP and treats every entry as a legitimate icon resource. Because WordPress executes any .php file accessible under the document root, dropping a PHP payload into the uploads directory turns a file write primitive into code execution. The flaw chains weak input validation with insufficient authorization checks, since author-level accounts should not be permitted to install theme assets.

Attack Vector

The attack requires network access to the WordPress admin interface and a valid authenticated session at author privilege or higher. The attacker uses the Betheme Icons upload flow to submit a ZIP archive containing a PHP webshell. Once upload_icons() extracts the archive into the uploads directory, the attacker requests the dropped PHP file directly through the browser. The PHP interpreter executes the payload, granting the attacker command execution under the web server user. Persistence and lateral movement typically follow through standard WordPress post-exploitation techniques, including credential theft from wp-config.php and database tampering.

Detection Methods for CVE-2026-6261

Indicators of Compromise

New .php, .phtml, or .phar files appearing under wp-content/uploads/ directories associated with Betheme icon packs.
ZIP archive uploads to admin endpoints invoking the upload_icons action from author-level accounts.
Outbound network connections initiated by the PHP-FPM or Apache process shortly after icon-pack upload activity.
Unexpected creation or modification of WordPress administrator accounts following an icon-pack upload event.

Detection Strategies

Monitor web server access logs for POST requests to admin-ajax.php or admin endpoints containing the upload_icons action parameter.
Alert on any execution of PHP files located under wp-content/uploads/ paths, which should never contain executable code.
Inspect ZIP uploads server-side and flag archives whose entries include extensions outside an icon allowlist such as .svg, .png, .eot, .ttf, .woff.
Correlate author-role authentication events with subsequent file write activity in theme-controlled upload directories.

Monitoring Recommendations

Enable file integrity monitoring on the entire wp-content/ tree with focus on the uploads subdirectory.
Forward WordPress audit logs and PHP error logs to a central SIEM for correlation against process execution telemetry.
Track creation of new author or higher-privileged accounts and flag those that perform file uploads within their first session.
Review weekly reports of newly created PHP files across all web roots and validate each against expected deployment activity.

How to Mitigate CVE-2026-6261

Immediate Actions Required

Update the Betheme theme to a version newer than 28.4 as published in the Muffin Group Changelog.
Audit all author-level and higher accounts and remove or reset any that are not strictly required.
Search wp-content/uploads/ for unexpected .php files and remove them after preserving forensic copies.
Rotate WordPress administrator passwords, database credentials, and any API keys stored in wp-config.php if compromise is suspected.

Patch Information

The vendor, Muffin Group, addresses the issue in a Betheme release subsequent to version 28.4. Refer to the Muffin Group Changelog for the specific fixed version and to the Wordfence Vulnerability Report for technical confirmation. Apply the update through the WordPress admin theme updater or by replacing the theme files manually from the vendor download.

Workarounds

Restrict the author role from accessing theme administration features through a capability management plugin until patching is complete.
Block execution of PHP files inside wp-content/uploads/ using a web server rule such as a .htaccess directive or Nginx location block.
Place the site behind a web application firewall configured to block multipart uploads containing PHP entries within ZIP archives.
Disable new user registration or set the default role to subscriber if author-level self-registration is not required.

bash

# Apache: deny PHP execution under wp-content/uploads
# Place in wp-content/uploads/.htaccess
<FilesMatch "\.(php|phtml|phar|php3|php4|php5|php7|phps)$">
    Require all denied
</FilesMatch>

# Nginx equivalent inside the server block
location ~* /wp-content/uploads/.*\.(php|phtml|phar)$ {
    deny all;
    return 403;
}