CVE-2025-6989: The Kallyas theme for WordPress is vulnerable to arbitrary folder deletion due to insufficient file path validation in the delete_font() function in all…

PriorityP349high8.1CVSS 3.1

AVNACLPRLUINSUCNIHAH

EPSS

0.43%

34.2th percentile

The Kallyas theme for WordPress is vulnerable to arbitrary folder deletion due to insufficient file path validation in the delete_font() function in all versions up to, and including, 4.21.0. This makes it possible for authenticated attackers, with Contributor-level access and above, to delete arbitrary folders on the server.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
hogash	kallyas_creative_ecommerce_multi-purpose_wordpress_theme	<= 4.21.0	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.