CVE-2026-73033

MediumCVSS 6.5/10Last modified Sep 17, 2026

Description

Sucuri Security WordPress plugin through version 2.7.3 contains a path traversal vulnerability in the pageIntegritySubmission() method in src/integrity.lib.php that allows authenticated administrators to delete arbitrary files by supplying directory traversal sequences in the sucuriscan_integrity parameter. Attackers can manipulate the unsanitized file path concatenated with ABSPATH to traverse outside the WordPress installation directory and invoke unlink() on sensitive files such as wp-config.php and .htaccess, causing site outage or enabling malicious reinstallation.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published: Aug 10, 2026
Last modified: Sep 17, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-730349.8DB-GPT v0.8.1 contains an unauthenticated path traversal vulnerability that allows remote attackers to write arbitrary files to any location CVE-2026-730354.3npm-check-updates through 23.0.2, fixed in commit b554b84, contains a terminal escape sequence injection vulnerability that allows an attack CVE-2026-730364.4Bash-it 3.2.0 contains a terminal escape sequence injection vulnerability in the barbuk theme's Python virtualenv prompt segment that allows CVE-2026-730376.1Next AI Draw.io 0.2.1 through 0.4.16 contains a reflected cross-site scripting vulnerability in the mcp query parameter that is interpolated CVE-2026-730386.1NodeBB before 4.15.0 contains a stored cross-site scripting vulnerability in the renderEmoji function that fails to escape tag.icon.url and CVE-2026-730395.4streama contains an insecure direct object reference vulnerability in ViewingStatusController that allows authenticated users to read and de CVE-2026-73049.8SGLangs multimodal generation runtime is vulnerable to unauthenticated remote code execution when the --enable-custom-logit-processor option CVE-2026-730408.8Dockge validates a stack name only on the write path. In backend/stack.ts the allow-list check in validate(), which requires the name to mat CVE-2026-730419.0SiYuan versions before v3.7.4 fail to validate or escape annotation fields written to disk by the setFileAnnotation endpoint. Attackers can CVE-2026-730429.0SiYuan before v3.7.4 fails to properly escape database menu metadata in HTML interpolation, allowing stored values to execute script when us CVE-2026-730439.0SiYuan versions before v3.7.4 contain a remote code execution vulnerability in the Template calculation operator, which renders user-authore CVE-2026-730449.0SiYuan versions before v3.7.4 fail to validate or escape table column width values, allowing stored cross-site scripting injection into styl