CVE-2026-6261

High

Published: 05 May 2026

Published

05 May 2026

Modified

05 May 2026

KEV Added

—

Patch

—

CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0026 49.9th percentile

Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-6261 is a high-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability in Muffingroup (inferred from references). Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 49.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 2 other techniques. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match

prevent

Remediating the flaw in the upload_icons() function by patching Betheme theme versions up to 28.4 directly prevents arbitrary file uploads and subsequent RCE.

SI-10 Information Input Validation good match

prevent

Implementing input validation mechanisms for user-controlled ZIP files and extracted contents addresses the core issue of lacking file type validation in the icon-pack upload workflow.

AC-6 Least Privilege partial match

prevent

Enforcing least privilege restricts author-level and higher access, reducing the attack surface for authenticated exploitation of the upload feature.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1505.003 Web Shell Persistence

Adversaries may backdoor web servers with web shells to establish persistent access to systems.

attack.mitre.org →

T1105 Ingress Tool Transfer Command And Control

Adversaries may transfer tools or other files from an external system into a compromised environment.

attack.mitre.org →

Why these techniques?

Arbitrary file upload vuln in public-facing WordPress directly enables exploitation of the web app (T1190) to upload/execute PHP web shell (T1505.003) and transfer malicious files (T1105).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

The Betheme theme for WordPress is vulnerable to Arbitrary File Upload in versions up to, and including, 28.4. This is due to the upload_icons() function workflow moving and unzipping user-controlled ZIP files into a public uploads directory without validating extracted…

file types. This makes it possible for authenticated attackers, with author-level access and above, to upload arbitrary files (including PHP) and achieve remote code execution via the Icons icon-pack upload flow.

Deeper analysisAI

CVE-2026-6261 is an arbitrary file upload vulnerability in the Betheme theme for WordPress, affecting versions up to and including 28.4. The flaw arises in the upload_icons() function workflow, which moves and unzips user-controlled ZIP files into a public uploads directory without validating the types of extracted files. This vulnerability carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and maps to CWE-434 (Unrestricted Upload of File with Dangerous Type).

Authenticated attackers with author-level access or higher can exploit the vulnerability via the Icons icon-pack upload flow. By supplying a malicious ZIP file containing arbitrary files, such as PHP code, they can place executable content in the public directory, enabling remote code execution on the targeted WordPress site.

Advisories and patch information are detailed in the Muffin Group changelog at https://support.muffingroup.com/changelog/ and Wordfence threat intelligence at https://www.wordfence.com/threat-intel/vulnerabilities/id/722c04c3-8f74-4081-b3a4-cb1ae2027312?source=cve, published on 2026-05-05.