Unauthenticated File Deletion in WordPress Plugin

The CODE MONKEYS PROPOSALS WordPress plugin through version 1.0.1 contains a critical arbitrary file deletion vulnerability that allows any authenticated user—including those with minimal privileges like subscribers—to delete arbitrary files from the web server. This vulnerability exists because the plugin fails to validate file paths before deletion and does not enforce proper capability checks. The impact is severe: attackers can delete essential WordPress configuration files, core system files, or application data, leading to complete site compromise, data loss, or enabling further exploitation. Any organization using this plugin is at risk, particularly those with permissive user registration policies or internal threats from low-privileged accounts.

While this CVE does not map to specific MITRE ATT&CK techniques in the advisory, Casky's 754 mapped security skills would detect the underlying attack patterns associated with this vulnerability. Practitioners using Casky would identify findings related to T1485 (Data Destruction), T1561 (Disk Wipe), and T1529 (System Shutdown/Reboot) patterns, as well as authorization bypass techniques under T1548 (Abuse of Elevation Control Mechanism). Claude's extended reasoning would flag suspicious file deletion operations originating from low-privileged authenticated sessions, path traversal indicators in request logs, and the absence of capability validation checks in plugin code analysis. Security teams would see alerts for repeated DELETE requests targeting sensitive files, failed file access attempts followed by successful deletions, and privilege escalation chains where subscriber accounts perform admin-level file operations.