A path traversal vulnerability in the beeteam368 VidMov theme allows authenticated users to perform unauthorized file operations, posing a significant security risk.

This is a path traversal vulnerability (CWE-35) that permits an authenticated attacker with low privileges to traverse directories using the .../...// sequence. The vulnerability exists within the theme's handling of file paths, which fails to properly sanitize user input.

The ability to perform path traversal can lead to unauthorized file access, potentially exposing sensitive configuration files or allowing an attacker to impact system integrity. With a CVSS score of 7.5, this high-severity flaw represents a significant risk to the confidentiality and integrity of the WordPress environment. Unauthorized access to system files can facilitate further exploitation, potentially leading to a full compromise of the affected web application.

Immediate Action: There is currently no patched version released; administrators should deactivate or remove the VidMov theme until an official update is provided by beeteam368.

Proactive Monitoring: Monitor server access logs for anomalous directory traversal patterns, specifically searching for the .../...// sequence in request parameters.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block path traversal attempts and suspicious input patterns targeting WordPress themes.

Public Exploit Available: No — exploit_available (unknown).

Given the high CVSS score, organizations currently utilizing the VidMov theme must treat this vulnerability with urgency. Because a patch is not yet confirmed, the most effective mitigation is to deactivate the theme immediately to prevent potential exploitation. Security teams should maintain vigilance and subscribe to vendor security notifications to ensure the update is applied as soon as it becomes available.