A critical vulnerability in the CODE MONKEYS PROPOSALS WordPress plugin allows authenticated users to delete arbitrary files, potentially resulting in a full site takeover.

This flaw, categorized as CWE-73, involves the improper validation of user-supplied file paths and a missing capability check. Any authenticated user, including those with subscriber-level access, can trigger the deletion of sensitive system or application files.

Successful exploitation of this vulnerability poses a severe risk to business continuity and data integrity. With a CVSS score of 9.6, the ability to delete arbitrary files can lead to a complete site takeover, causing significant downtime, loss of operational control, and potential permanent data destruction.

Immediate Action: Since no patch is currently confirmed, administrators should immediately deactivate and uninstall the CODE MONKEYS PROPOSALS plugin until a secure version is released by the vendor.

Proactive Monitoring: Security teams should review web server access logs for anomalous requests targeting file deletion endpoints or unexpected modifications to the file system.

Compensating Controls: Implement a Web Application Firewall (WAF) to block suspicious requests that attempt to pass file paths as parameters to plugin-related functions.

Public Exploit Available: No (exploit_available unknown).

Given the critical severity and the potential for total site compromise, immediate removal of the vulnerable software is the only effective way to mitigate this risk. Security teams should prioritize the identification of any instances of this plugin in their environment and ensure they are disabled until the vendor provides a patched release.