Description

The CODE MONKEYS PROPOSALS WordPress plugin through 1.0.1 does not validate a user-supplied file path before deleting a file, and does not check the capability of the user making the request, allowing any authenticated user, such as a subscriber, to delete arbitrary files on the server, which can lead to a site takeover.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.6",
  "pubDate": "2026-09-12T06:16:24.623Z",
  "pubdate": "2026-09-12T06:16:24.623Z",
  "executiveSummary": "The CODE MONKEYS PROPOSALS WordPress plugin, specifically versions up to and including 1.0.1, contains a critical security vulnerability involving improper validation of user-supplied input.\nThe vulnerability is classified as an Arbitrary File Deletion flaw. It stems from a failure to perform input path validation and missing authorization checks on file-deletion requests.\nAny authenticated user, including those with minimal privileges such as a subscriber, can leverage this vulnerability to delete arbitrary files on the underlying web server.\nSuccessful exploitation allows an attacker to delete core WordPress configuration files, themes, or plugins, potentially resulting in a complete site takeover, denial of service, or forced reconfiguration of the application.\nThis vulnerability poses a significant risk to the integrity and availability of the WordPress installation, as it requires only basic authenticated access to execute destructive operations on the filesystem.",
  "technicalDetails": "The vulnerability exists within the file-handling logic of the CODE MONKEYS PROPOSALS plugin. The application fails to sanitize or validate file paths submitted via user-supplied parameters before passing them to filesystem deletion functions, such as unlink().\nFurthermore, the plugin lacks mandatory access control checks. It does not verify the capability or administrative role of the user initiating the file deletion request, allowing unauthorized users to trigger destructive filesystem operations.\nThe attack flow begins when an authenticated user sends a crafted request to the plugin's file deletion endpoint. Because the plugin does not enforce capability checks (e.g., using current_user_can('manage_options')), the request is processed regardless of the user's privilege level.\nThe application then takes the user-provided path—which may include directory traversal sequences such as '../'—and directly attempts to delete the referenced file. By manipulating the path, an attacker can escape the intended directory and target sensitive system files.\nAn attacker can target critical files like wp-config.php. Once deleted, the WordPress installation may return to its initial setup state, allowing an attacker to reconfigure the database credentials, create a new administrative user, or otherwise assume control of the site.\nBecause the plugin executes these functions with the privileges of the web server process (e.g., www-data), the scope of the deletion is limited only by the filesystem permissions assigned to the web server user.\nThis vulnerability is classified as a lack of authorization and improper neutralization of special elements used in a path, commonly associated with CWE-862 (Missing Authorization) and CWE-73 (External Control of File Name or Path).\nGiven that the exploit requires only a standard subscriber account, the attack surface is significantly expanded. There is no requirement for high-level administrative credentials, making this an ideal target for post-compromise lateral movement or initial site disruption."
}