Description

Sucuri Security WordPress plugin through version 2.7.3 contains a path traversal vulnerability in the pageIntegritySubmission() method in src/integrity.lib.php that allows authenticated administrators to delete arbitrary files by supplying directory traversal sequences in the sucuriscan_integrity parameter. Attackers can manipulate the unsanitized file path concatenated with ABSPATH to traverse outside the WordPress installation directory and invoke unlink() on sensitive files such as wp-config.php and .htaccess, causing site outage or enabling malicious reinstallation.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-10T21:17:26.610Z",
  "pubdate": "2026-08-10T21:17:26.610Z",
  "executiveSummary": "The Sucuri Security WordPress plugin through version 2.7.3 suffers from a path traversal vulnerability residing in the pageIntegritySubmission() method within src/integrity.lib.php. This security flaw enables authenticated administrators to supply directory traversal sequences via the sucuriscan_integrity parameter, leading to the arbitrary deletion of files on the underlying filesystem.\nThe primary impact of this vulnerability involves the unauthorized removal of critical configuration and system files, such as wp-config.php and .htaccess. Successful exploitation directly results in denial of service conditions through site outages and can potentially facilitate malicious reinstallation scenarios by stripping core security constraints.\nThe affected system is the Sucuri Security WordPress plugin across all versions up to 2.7.3. Exploitation of this vulnerability requires administrative authentication, meaning an attacker must first compromise or possess administrative privileges within the target WordPress environment to interact with the vulnerable method.",
  "technicalDetails": "The vulnerability stems from improper input validation and sanitization within the pageIntegritySubmission() method located in src/integrity.lib.php of the Sucuri Security WordPress plugin through version 2.7.3.\nSpecifically, the application accepts user-supplied input via the sucuriscan_integrity parameter and unsafely concatenates this value directly with the ABSPATH constant, which defines the absolute path to the WordPress installation directory.\nBecause the input lacks adequate path normalization or validation to restrict operations within the intended directory boundaries, an authenticated attacker can inject directory traversal sequences such as dot-dot-slash (../) notations.\nThe step-by-step attack flow proceeds as follows: First, the authenticated attacker crafts an HTTP request containing directory traversal payloads within the sucuriscan_integrity parameter. Second, the vulnerable pageIntegritySubmission() method processes the input and appends it to ABSPATH without stripping traversal sequences. Third, the resulting manipulated file path traverses outside the WordPress installation directory to point to sensitive system or application files. Finally, the application invokes the PHP unlink() function on the constructed path, resulting in the immediate deletion of the targeted file.\nThe vulnerable component is the file integrity checking subsystem of the Sucuri Security plugin. The requirement for exploitation includes valid administrative privileges and authentication within the WordPress administration panel, limiting the attack vector to malicious insiders or attackers who have successfully achieved administrative account takeover."
}