CVE-2026-62261

CVE-2026-6261 is an arbitrary file upload vulnerability found in the Betheme theme for WordPress, affecting versions up to and including 28.4. The flaw exists within the `upload_icons()` function, which is responsible for handling icon-pack uploads. This function processes user-supplied ZIP archives by moving and unzipping their contents into a public uploads directory without adequately validating the types of files being extracted. This vulnerability allows authenticated attackers with author-level access or higher to exploit the icon-pack upload workflow. By uploading a specially crafted ZIP file containing malicious PHP files, attackers can achieve remote code execution on the affected WordPress installation. The root cause is attributed to the lack of file type validation after archive extraction, as the handler trusts the contents of the user-supplied ZIP without enforcing an allowlist of file extensions or validating MIME types.