Unauthenticated Arbitrary File Deletion in WordPress File Manager

The Frontend File Manager Plugin for WordPress versions through 23.6 contains a critical path traversal vulnerability that permits unauthenticated users to delete arbitrary files from the server. The flaw stems from insufficient validation of file paths derived from user input before executing deletion operations. This vulnerability is particularly dangerous when the plugin's guest upload mode is enabled, as it removes the authentication barrier entirely. The attack becomes especially severe when attackers target wp-config.php, the WordPress configuration file containing database credentials and security keys. Deletion of this file forces WordPress into its setup routine, providing attackers with a direct pathway to full site takeover by allowing them to reconfigure the application with malicious credentials. Organizations running vulnerable versions of this plugin face complete loss of confidentiality, integrity, and availability of their WordPress installations.

Casky's extended reasoning capabilities would identify attack patterns associated with this vulnerability by analyzing indicators across multiple MITRE ATT&CK techniques, including T1070 (Indicator Removal), T1485 (Data Destruction), and T1565 (Data Manipulation). Practitioners using Casky would detect suspicious activity patterns such as unauthenticated HTTP POST requests to the plugin's file deletion endpoints, path traversal sequences in request parameters (../, ..\), and file system events showing deletion of critical WordPress configuration files by unexpected processes. The platform's security skills would flag anomalous file deletion activity targeting wp-config.php or other critical system files originating from web server processes, correlate unauthenticated access attempts with subsequent administrative access, and identify the characteristic request signatures of exploitation attempts. By mapping these behavioral indicators to the underlying ATT&CK framework, Casky enables practitioners to distinguish legitimate file management operations from exploitation attempts and respond before attackers achieve their objectives.