Executive brief
The Code Monkeys Proposals WordPress plugin allows any authenticated user (including low-privilege subscribers) to delete arbitrary files on the server without proper validation. An attacker can exploit this to remove critical WordPress files, configuration files, or other essential server content, leading to complete site takeover, data loss, or denial of service.
Technical details
This is a path traversal and arbitrary file deletion vulnerability (CWE-73). The vulnerable plugin accepts a user-supplied file path in a deletion function but fails to validate the path or check user capabilities before executing the delete operation. Any authenticated user—including low-privilege subscribers—can craft a request with a path traversal payload (e.g., `../../wp-config.php`) to delete files outside the intended directory. The attack requires only authentication to the WordPress site; network access to the site and an active user account are the only preconditions. An attacker can delete critical system files leading to complete site compromise.
Affected products
- Code Monkeys Proposals through 1.0.1
Timeline
- 2026-09-10: disclosed
- 2026-09-12: advisory