Description

Editor Arbitrary File Deletion in Fluent Boards Pro <= 2.0.11 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.8",
  "pubDate": "2026-08-27T10:16:37.510Z",
  "pubdate": "2026-08-27T10:16:37.510Z",
  "executiveSummary": "Fluent Boards Pro versions 2.0.11 and below are susceptible to an Arbitrary File Deletion vulnerability.\nThis security flaw resides in an improper access control mechanism within the plugin's file handling functions, allowing authenticated users with an 'Editor' role to delete arbitrary files from the server.\nThe vulnerability poses a critical risk to the availability and integrity of the hosting environment.\nAn attacker capable of authenticating as an Editor can leverage this flaw to remove essential application configuration files, WordPress core files, or security-related files, potentially leading to a complete Denial of Service (DoS) or creating conditions for further system compromise.\nSuccessful exploitation does not require advanced technical skill, as the issue stems from a lack of validation and authorization checks on file deletion requests submitted to the server.\nThe vulnerability is limited to authenticated users with the Editor capability, restricting the initial attack vector, yet the impact of file system manipulation remains severe.",
  "technicalDetails": "The vulnerability is rooted in an insecure implementation of a file management or cleanup function within the Fluent Boards Pro plugin codebase.\nSpecifically, the plugin fails to enforce strict authorization and path validation checks when processing requests intended to delete files from the web server.\nWhile the intended functionality may have been to permit Editors to manage plugin-specific uploads or cached content, the lack of input sanitization and access control verification allows for directory traversal or direct path manipulation.\nAn attacker with Editor privileges can craft a malicious HTTP request targeting the vulnerable endpoint responsible for file deletion operations.\nBy manipulating parameters—typically involving file paths—within this request, the attacker can force the application to delete files residing outside of the intended directory.\nThe process occurs as follows: first, the attacker identifies the request structure used for deleting files within the plugin's backend interface. Second, the attacker intercepts or manually constructs a request containing a path traversal sequence (e.g., ../../../) or an absolute path to a sensitive file.\nBecause the server-side code executes the deletion operation without validating whether the target file belongs to the plugin's legitimate scope or if the authenticated Editor has the necessary permissions to access and delete the specified file, the operation is carried out by the web server process.\nThe vulnerability affects Fluent Boards Pro versions <= 2.0.11. The impact of this flaw is significant; the ability to delete arbitrary files can disrupt system stability, delete configuration files such as wp-config.php (which may trigger a site reset or misconfiguration), or remove files required for the continued operation of the WordPress installation.\nThis vulnerability highlights a failure in the Principle of Least Privilege and insufficient input validation during file system interactions."
}