An authenticated administrative user can exploit a path traversal vulnerability in the Better Messages WordPress plugin to delete arbitrary files from the server.

The plugin contains a path traversal vulnerability (CWE-22) within the delete_sticker function. An attacker with administrative privileges can manipulate file paths to delete arbitrary files on the host server, leading to potential system instability or data loss.

While this vulnerability requires high privileges, the ability to delete arbitrary files can lead to the removal of critical system configuration files or application components. With a CVSS score of 7.2, the impact is severe, potentially resulting in full system compromise or permanent site failure if critical files are removed.

Immediate Action: Update the Better Messages plugin to the latest version to patch the path validation logic in the delete_sticker function.

Proactive Monitoring: Audit administrative user activity and monitor for unusual file deletion operations or unexpected changes to the filesystem.

Compensating Controls: Restrict administrative access to trusted personnel only and employ file integrity monitoring (FIM) tools to detect unauthorized file deletions.

Public Exploit Available: No (unknown)

Administrators should treat this vulnerability with urgency, especially in multi-user environments. Applying the patch is the most effective way to prevent abuse of the administrative interface for malicious file destruction.