CVE-2026-73033 in Security Plugin
Summary
by MITRE • 08/11/2026
Sucuri Security WordPress plugin through version 2.7.3 contains a path traversal vulnerability in the pageIntegritySubmission() method in src/integrity.lib.php that allows authenticated administrators to delete arbitrary files by supplying directory traversal sequences in the sucuriscan_integrity parameter. Attackers can manipulate the unsanitized file path concatenated with ABSPATH to traverse outside the WordPress installation directory and invoke unlink() on sensitive files such as wp-config.php and .htaccess, causing site outage or enabling malicious reinstallation.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/11/2026
This vulnerability exists within the Sucuri Security WordPress plugin version 2.7.3 and earlier, representing a critical path traversal flaw that directly impacts the integrity and security of WordPress installations. The issue is specifically located in the pageIntegritySubmission() method within the src/integrity.lib.php file where user-supplied input is not properly sanitized before being used to construct file paths. The vulnerability arises from the concatenation of unsanitized user input with the ABSPATH constant, which represents the absolute path to the WordPress installation directory. When an authenticated administrator processes a malicious request containing directory traversal sequences such as ../ or ..\ in the sucuriscan_integrity parameter, the system fails to validate or sanitize this input properly, allowing attackers to manipulate the file path construction logic.
The technical execution of this vulnerability requires an attacker to have administrative privileges within the WordPress environment, which significantly reduces the attack surface but does not eliminate the risk entirely. Once authenticated, the malicious actor can craft requests that exploit the improper input handling by injecting traversal sequences into the sucuriscan_integrity parameter. The system then concatenates this unsanitized input with ABSPATH and executes an unlink() operation on the resulting file path, effectively allowing deletion of any file within the WordPress directory structure. This capability extends beyond simple file removal to potentially compromise critical system files such as wp-config.php which contains database credentials and security keys, or .htaccess files that control server configuration and access controls.
The operational impact of this vulnerability can be catastrophic for affected WordPress installations, potentially leading to complete site outages or enabling attackers to gain persistent access through malicious reinstallation processes. When attackers delete sensitive configuration files like wp-config.php, they effectively disable the WordPress installation's ability to function properly, requiring manual intervention to restore the system. The deletion of .htaccess files can remove critical security configurations and rewrite rules that protect against common attacks such as sql injection or directory traversal attempts. From a cybersecurity perspective, this vulnerability aligns with CWE-22 Path Traversal and represents a privilege escalation vector that allows authenticated users to perform unauthorized operations beyond their intended scope.
The attack pattern follows established methodologies described in the MITRE ATT&CK framework under techniques related to privilege escalation and persistence. Specifically, this vulnerability enables an attacker to move laterally within the compromised WordPress environment by removing critical system files or installing malicious code through reinstallation processes. Organizations should implement immediate mitigations including updating to patched versions of the Sucuri Security plugin, reviewing administrator access controls, and monitoring for suspicious activity in WordPress admin areas. Additionally, implementing proper input validation and sanitization practices, such as using realpath() functions to normalize file paths before processing, can prevent similar vulnerabilities from occurring in other components. Regular security audits and principle of least privilege implementations are essential for reducing the risk exposure associated with authenticated path traversal vulnerabilities in web applications.