Brief Summary: Betheme CVE-2026-6261 Arbitrary File Upload to Remote Code Execution via Icon Pack Upload

Introduction

A missing file type validation in Betheme's icon pack upload workflow lets any authenticated WordPress user with Author privileges drop a PHP webshell into a publicly accessible directory and execute it remotely. Betheme has over 325,000 active installations and more than 334,000 total sales on ThemeForest, so the potential blast radius of CVE-2026-6261 is substantial.

Betheme is a commercial responsive multipurpose WordPress and WooCommerce theme developed by MuffinGroup. It is one of the top-selling themes on the Envato ThemeForest marketplace, and agencies, small businesses, and enterprise marketing sites use it widely.

Technical Information

Root Cause

The vulnerability is classified under CWE-434 (Unrestricted Upload of File with Dangerous Type) and has a CVSS score of 8.8. The root cause is in the upload_icons() function in the Betheme theme, which handles custom icon pack uploads. It moves a user-supplied ZIP archive to the WordPress uploads directory, then extracts the contents into a publicly accessible path. Nothing checks the file types inside the ZIP after extraction. The function trusts the archive entirely, so any file type, including .php, is written to disk in a location directly reachable via HTTP.

Attack Flow

1. The attacker needs an authenticated WordPress session with at least Author privileges. Sites commonly give this role to content creators, marketing personnel, and external contributors, so a compromised or malicious account at this level is a realistic scenario.

2. The attacker builds a ZIP file containing a PHP webshell (or any other executable PHP script), optionally alongside legitimate icon font files to avoid casual inspection.

3. The attacker submits the crafted ZIP through Betheme's Icons icon pack upload flow. The upload_icons() function accepts the archive without inspecting its contents.

4. The function moves the ZIP to the WordPress uploads directory and extracts every file in it. It runs no allowlist or blocklist check on extracted file extensions, so the PHP file is written to disk in wp-content/uploads/ (or a subdirectory of it).

5. The attacker navigates to the URL of the extracted PHP file. The file sits in a publicly accessible directory, so the web server executes it and the attacker gets remote code execution on the underlying server.

Discovery and Disclosure Timeline

Researchers Webbernaut and Leonid Semenenko discovered the vulnerability. MuffinGroup released Betheme version 28.4 on April 9, 2026. The patched version 28.4.1 followed on April 20, 2026, and a regression fix (28.4.1.1) shipped on April 21, 2026. Wordfence published the vulnerability details and assigned the CVE on May 4, 2026, so the patch was available roughly two weeks before full public disclosure.

Patch Information

MuffinGroup fixed CVE-2026-6261 in Betheme version 28.4.1, released on April 20, 2026, and followed up a day later with version 28.4.1.1 on April 21, 2026. The second release fixes a PHP Fatal Error that the first patch introduced on non-WooCommerce sites.

Version 28.4.1 hardens the upload_icons() code path by validating the file types extracted from the uploaded ZIP archive. After decompression, the patched code checks each extracted file against an allowlist of safe extensions, the icon font asset types a pack is expected to contain: .css, .eot, .svg, .ttf, .woff, .woff2, and .json. It rejects and removes any file outside that list before it can be written to the public uploads directory, which effectively closes the arbitrary file upload vector.

Betheme is a commercial theme distributed through ThemeForest and the Muffin Group dashboard rather than an open-source repository, so there is no public code diff or commit to inspect. The Wordfence advisory does explicitly confirm the patched status. Its remediation reads: "Update to version 28.4.1, or a newer patched version."

The current recommended update target is 28.4.1.1, which fixes both the security vulnerability and the regression the first security patch introduced. Site administrators running Betheme should update immediately through the WordPress dashboard or by downloading the latest version from ThemeForest. If a site ran the vulnerable version at any point, administrators should also audit the wp-content/uploads/ directory for unexpected .php files that may have been planted through this attack vector before the update was applied.

Affected Systems and Versions

Every release of the Betheme WordPress theme up to and including version 28.4 is affected.

The vulnerability requires:

• An active Betheme theme installation on WordPress
• At least one user account with Author, Editor, or Administrator role privileges
• The icon pack upload functionality to be accessible (which it is by default for these roles)

The fixed versions are:

• 28.4.1 (April 20, 2026): initial security patch
• 28.4.1.1 (April 21, 2026): security patch plus regression fix for non-WooCommerce sites (recommended update target)

Vendor Security History

Wordfence tracks 21 distinct vulnerabilities for the Betheme theme, a pattern that warrants ongoing vigilance. Notable historical vulnerabilities include:

These vulnerabilities keep returning to authorization checks and file handling, which suggests that organizations using Betheme should treat theme updates as regular security maintenance rather than an occasional task.

References

• NVD: CVE-2026-6261
• Wordfence Vulnerability Advisory: Betheme <= 28.4 Arbitrary File Upload to RCE
• Betheme Changelog (Muffin Group Support Center)
• Betheme on ThemeForest
• Wordfence: Betheme Vulnerability History