Description

Unauthenticated Arbitrary File Deletion in ShopBuilder Pro – Elementor WooCommerce Builder Addons <= 2.2.0 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.6",
  "pubDate": "2026-08-24T12:16:51.473Z",
  "pubdate": "2026-08-24T12:16:51.473Z",
  "executiveSummary": "An unauthenticated arbitrary file deletion vulnerability exists in the ShopBuilder Pro – Elementor WooCommerce Builder Addons plugin for WordPress, specifically affecting versions 2.2.0 and below. This security flaw allows remote, unauthenticated attackers to delete arbitrary files from the underlying web server filesystem, potentially leading to critical application disruption, denial of service, or further exploitation vectors such as administrative account takeover if critical configuration or installation files are removed.\nThe vulnerability stems from improper input validation and insecure file handling within the plugin's codebase, where user-supplied parameters are processed without sufficient authorization checks or path sanitization. Consequently, any external actor capable of interacting with the target web application can issue crafted requests targeting sensitive system files or application components.\nThe risk implication is severe due to the irreversible nature of file deletion and the potential compromise of the hosting environment's integrity. Exploitation requires no prior authentication, privileges, or user interaction, lowering the barrier to entry for malicious actors scanning for vulnerable WordPress deployments. Remediation relies strictly on updating the affected software to a patched version once released by the vendor, as no alternative workarounds are inherently guaranteed without modifying core plugin code.",
  "technicalDetails": "The vulnerability resides within the ShopBuilder Pro – Elementor WooCommerce Builder Addons plugin, affecting all versions up to and including 2.2.0. The root cause of the flaw stems from insecure implementation of file deletion functionality, where input parameters designating target file paths are accepted from untrusted HTTP requests without adequate validation, sanitization, or access control enforcement.\nBecause the vulnerable endpoints lack authentication and privilege verification mechanisms, the attack surface is exposed over the network to any unauthenticated remote attacker. An attacker can interact directly with the vulnerable component by submitting maliciously crafted HTTP requests containing specific parameters designed to traverse or point to arbitrary file locations on the filesystem of the hosting server.\nThe step-by-step attack flow initiates with the attacker identifying a vulnerable WordPress instance running ShopBuilder Pro <= 2.2.0. The attacker crafts an HTTP request targeting the exposed functionality responsible for handling file operations. By supplying a targeted file path or relative traversal sequence within the insecure parameter, the attacker bypasses intended functional constraints.\nUpon receiving the request, the vulnerable component processes the input without verifying whether the requesting user possesses administrative privileges or authorization to modify or delete files. The underlying application executes the deletion routine using the web server process permissions, resulting in the removal of the targeted file from the disk.\nThe post-exploitation impact depends heavily on which files the attacker targets. Potential scenarios include the deletion of the wp-config.php file to induce a denial of service or force a re-installation routine, the removal of plugin or theme files to destabilize the site, or the deletion of specific lock and maintenance files. Due to the lack of authentication requirements and direct network exposure, automated exploitation scripts can easily leverage this flaw at scale against vulnerable targets."
}