PT-2025-30968 · WordPress · Kallyas

Matthew Rollings · Published 2025-07-26 · Updated 2025-07-26 · CVE-2025-6989

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Kallyas versions prior to 4.21.1

Description The Kallyas theme for WordPress is susceptible to arbitrary folder deletion due to inadequate file path validation within the delete font() function. Authenticated attackers possessing Contributor-level access or higher can exploit this issue to delete arbitrary folders on the server.

Recommendations Update Kallyas to version 4.21.1 or later.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2025-6989

Affected Products

Kallyas

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-6989 · Security Note
• https://themeforest.net/item/kallyas-responsive-multipurpose-wordpress-theme/4091658 · Note
• https://twitter.com/VulmonFeeds/status/1949053804554457335 · Twitter Post
• https://twitter.com/CVEnew/status/1949010312776036776 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/9a8a3607-4f2e-44fb-8141-75f7620508d4?source=cve · Note