WordPress Plugin Path Traversal Enables Arbitrary File Deletion

The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_sticker function in all versions up to, and including, 2.15.19. This makes it possible for authenticated attackers, with administrator-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The prefix check intended to restrict deletion to the uploads directory can be bypassed by crafting a URL that begins with the legitimate uploads base URL but embeds ../ traversal sequences in the path portion, as the normalize_sticker function only applies esc_url_raw(), which does not strip ../ sequences, allowing the traversal payload to be stored verbatim in WordPress options.

Casky was already ahead

This CVE exploits attack patterns that Casky's 351matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The Better Messages WordPress plugin contains a critical path traversal vulnerability in its delete_sticker function that allows authenticated administrators to delete arbitrary files from the web server. By bypassing file path validation, attackers can remove essential WordPress files like wp-config.php, causing immediate denial of service and creating conditions for remote code execution. This vulnerability affects all versions up to 2.15.19 and is particularly dangerous because it requires only administrative privileges—a common attack vector in WordPress environments where compromised admin accounts or malicious insiders pose significant risk.

Casky's 351 matched skills leverage Claude's extended reasoning to identify the attack patterns underlying this vulnerability across MITRE ATT&CK techniques TA0001 (Reconnaissance) and TA0007 (Discovery). Practitioners using Casky would detect suspicious activity patterns including: unexpected administrative API calls to the delete_sticker endpoint with non-standard file paths, CWE-22 path traversal indicators in request parameters, file system access logs showing deletion of critical configuration files, and behavioral anomalies indicating lateral movement preparation. The platform's skill-mapping would highlight how initial access through admin compromise (TA0001) followed by system enumeration (TA0007) precedes exploitation, enabling defenders to recognize the full kill chain and implement preventive controls before critical file deletion occurs.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

351 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-16585.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0007

Investigate the attack patterns behind CVE-2026-16585

Casky has 351 skills that investigate the attack patterns behind CVE-2026-16585. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn