A critical path traversal vulnerability in the Whitebox-Studio Scape theme allows unauthenticated remote attackers to trigger arbitrary file deletion, potentially leading to service disruption.

This vulnerability is a path traversal flaw (CWE-22) residing in the Scape theme, which permits an unauthenticated attacker to manipulate file paths and delete critical files on the host server.

The ability for an unauthenticated attacker to delete arbitrary files poses a severe risk to business continuity and data integrity. Because this flaw allows for the deletion of system or application files, it can lead to immediate denial of service or the destruction of essential configuration and content, justifying its high CVSS score of 8.6.

Immediate Action: Update the Whitebox-Studio Scape theme to version 1.5.16 or later immediately to resolve the directory traversal flaw.

Proactive Monitoring: Review web server access logs for suspicious requests containing directory traversal sequences, such as dot-dot-slash patterns, directed toward the theme directory.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block path traversal attempts and sanitize input parameters to prevent unauthorized file system access.

Public Exploit Available: No (exploit_available: false)

Given the severity of this vulnerability and the potential for total service disruption through arbitrary file deletion, administrators must prioritize patching the Scape theme. Ensure all instances are updated to version 1.5.16 or higher to eliminate this exposure and prevent potential exploitation by unauthenticated actors.