CVE-2026-73033
Sucuri WordPress Plugin 2.7.3 Path Traversal via integrity.lib.php
CVSS Score
6.5
EPSS Score
0.0%
EPSS Percentile
0th
Sucuri Security WordPress plugin through version 2.7.3 contains a path traversal vulnerability in the pageIntegritySubmission() method in src/integrity.lib.php that allows authenticated administrators to delete arbitrary files by supplying directory traversal sequences in the sucuriscan_integrity parameter. Attackers can manipulate the unsanitized file path concatenated with ABSPATH to traverse outside the WordPress installation directory and invoke unlink() on sensitive files such as wp-config.php and .htaccess, causing site outage or enabling malicious reinstallation.
| CWE | CWE-22 |
| Vendor | sucuri |
| Product | sucuri-wordpress-plugin |
| Published | Aug 10, 2026 |
Stay Ahead of the Next One
Get instant alerts for sucuri sucuri-wordpress-plugin
Be the first to know when new medium vulnerabilities affecting sucuri sucuri-wordpress-plugin are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
High
Affected Versions
Sucuri / sucuri-wordpress-plugin
0 ≤ 2.7.3
References
Credits
MD Mahmidul Hasan