The Home Villas WordPress theme contains a critical path traversal vulnerability allowing authenticated attackers to delete arbitrary server files, potentially leading to remote code execution.

This vulnerability is a path traversal flaw (CWE-22) located in the wp_rem_cs_widget_file_delete function. It permits attackers with at least Subscriber-level authentication to bypass file path restrictions and delete sensitive server files, such as wp-config.php.

The ability to delete arbitrary files on the web server presents a severe risk to business operations, including the potential for full system compromise via remote code execution. With a CVSS score of 8.8, this vulnerability is categorized as High, reflecting the significant impact on confidentiality, integrity, and availability. Unauthorized deletion of core configuration files can result in immediate site downtime, data loss, and prolonged service disruption.

Immediate Action: As no patched version is currently confirmed, administrators should immediately deactivate or remove the Home Villas theme from their WordPress environment until a security update is released by the vendor.

Proactive Monitoring: Review server logs for unusual file deletion activity or attempts to access or modify sensitive configuration files, specifically looking for requests directed toward the theme's backend widgets directory.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block directory traversal patterns and restrict access to the theme's backend files for non-administrative users.

Public Exploit Available: Unknown

Given the potential for total system compromise, this vulnerability poses an unacceptable risk to infrastructure stability. Administrators must prioritize the removal of the vulnerable theme immediately. If the theme is business-critical, implement strict access controls and monitor all file system changes until the vendor provides a formal patch.