CyberRota Analysis
AI-GeneratedThe Sucuri Security WordPress plugin, up to version 2.7.3, is vulnerable to a path traversal flaw that allows authenticated administrators to delete arbitrary files by exploiting unsanitized input in the pageIntegritySubmission() method. This could lead to the deletion of critical files like wp-config.php and .htaccess, potentially causing site outages or facilitating malicious reinstallation. WordPress site administrators using this plugin should prioritize applying the necessary updates to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Sucuri Security WordPress plugin through version 2.7.3 contains a path traversal vulnerability in the pageIntegritySubmission() method in src/integrity.lib.php that allows authenticated administrators to delete arbitrary files by supplying directory traversal sequences in the sucuriscan_integrity parameter. Attackers can manipulate the unsanitized file path concatenated with ABSPATH to traverse outside the WordPress installation directory and invoke unlink() on sensitive files such as wp-config.php and .htaccess, causing site outage or enabling malicious reinstallation.