Unvalidated URL Path Traversal in WordPress Cache Plugin

CVE-2026-19253 is a critical path traversal vulnerability in the Cache Enabler WordPress plugin that allows unauthenticated attackers to delete arbitrary files and directories on vulnerable servers. The plugin fails to validate user-supplied URLs before using them to construct filesystem paths in its cache purge routine, and critically, does not restrict deletion operations to the cache directory. This means an attacker can craft malicious requests that traverse outside intended boundaries using path manipulation techniques (e.g., "../../../") to target sensitive system files, configuration files, or other critical data. Any WordPress site running Cache Enabler before version 1.8.17 is affected, with exploitation requiring no authentication—making this a high-severity risk for the estimated millions of WordPress installations using this plugin.

While this CVE does not map directly to existing MITRE ATT&CK techniques in Casky's current skill set, the underlying attack pattern represents a classic Input Validation failure (CWE-73) that would be detected through Casky's extended reasoning capabilities by identifying suspicious file deletion patterns and path traversal indicators in server logs and request patterns. A practitioner using Casky would observe findings related to unusual DELETE or unlink operations targeting files outside the wp-content/cache directory, unexpected file system access to sensitive paths like wp-config.php or /etc/, and unauthenticated HTTP requests containing encoded or obfuscated path traversal sequences (../, ..\, or URL-encoded variants). The AI-driven analysis would correlate these indicators as potential exploitation attempts even in the absence of direct ATT&CK mapping, flagging the attack pattern's destructive intent and the need for immediate plugin updates and WAF rules to block requests with path traversal payloads.