Kallyas <= 4.21.0 - Authenticated (Contributor+) Willkürliches Löschen von Ordnern

An attacker exploiting this vulnerability could gain significant control over a WordPress website's server. By deleting critical folders, they could disrupt website functionality, compromise sensitive data stored within those folders (e.g., database backups, configuration files), or even escalate their privileges to gain full server access. The ability to delete arbitrary folders represents a severe compromise, potentially leading to complete website defacement or data exfiltration. This vulnerability is particularly concerning given the theme's popularity and widespread use in e-commerce environments, where sensitive customer data is often stored.

Websites using the KALLYAS theme, particularly those with contributor-level users who have write access to the WordPress file system, are at risk. Shared hosting environments where users have limited control over server file permissions are also particularly vulnerable. Sites running older, unpatched versions of the theme are most susceptible.

• wordpress / composer / npm:

wp plugin list | grep kallyas

• wordpress / composer / npm:

grep -r 'delete_font(' /var/www/html/wp-content/plugins/kallyas/*

• wordpress / composer / npm:

wp plugin update kallyas --all

• wordpress / composer / npm:

wp theme list | grep kallyas

1. 2025-07-26Disclosure

   disclosure

1. Reserviert2025-07-01
2. Veröffentlicht2025-07-26
3. Geändert2026-04-08
4. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2025-6989 is to upgrade to a patched version of the KALLYAS theme. If upgrading immediately is not feasible, implement temporary workarounds. A Web Application Firewall (WAF) can be configured to block requests to the delete_font() function or to validate the file path being deleted. Additionally, restrict user roles to the minimum necessary permissions, preventing contributors from having the ability to delete files. Regularly review user roles and permissions to ensure they align with the principle of least privilege. After upgrading, verify the fix by attempting to delete a test folder with a contributor account; the action should be denied.