CVE-2026-73033

Received Received - Intake

Authenticated Path Traversal in Sucuri Security WordPress Plugin

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: VulnCheck

Description

Sucuri Security WordPress plugin through version 2.7.3 contains a path traversal vulnerability in the pageIntegritySubmission() method in src/integrity.lib.php that allows authenticated administrators to delete arbitrary files by supplying directory traversal sequences in the sucuriscan_integrity parameter. Attackers can manipulate the unsanitized file path concatenated with ABSPATH to traverse outside the WordPress installation directory and invoke unlink() on sensitive files such as wp-config.php and .htaccess, causing site outage or enabling malicious reinstallation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-10

Last Modified

2026-08-10

Generated

2026-08-11

AI Q&A

2026-08-11

EPSS Evaluated

N/A

NVD

CVE-2026-73033

EUVD

EUVD-2026-55803

Affected Vendors & Products

Vendor	Product	Version / Range
sucuri	sucuri_security	2.7.3

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

This is a path traversal vulnerability in the Sucuri Security WordPress plugin up to version 2.7.3. It allows authenticated administrators to delete arbitrary files by exploiting unsanitized input in the sucuriscan_integrity parameter. The vulnerability occurs in the pageIntegritySubmission() method where directory traversal sequences can be used to manipulate file paths, potentially accessing files outside the WordPress directory like wp-config.php or .htaccess.

Impact Analysis

An attacker with administrator access could delete critical WordPress files such as wp-config.php or .htaccess, causing site outages or allowing malicious reinstallation. This could lead to complete website compromise, data loss, or unauthorized access to sensitive information.

Compliance Impact

This vulnerability could lead to unauthorized file deletion or site compromise, potentially violating data integrity and availability requirements under GDPR and HIPAA. If sensitive data is exposed or lost due to this flaw, organizations may face compliance violations, regulatory fines, or reputational damage.

Mitigation Strategies

Immediately update the Sucuri Security WordPress plugin to the latest version beyond 2.7.3 to patch the path traversal vulnerability. If an update is not available, consider disabling or removing the plugin until a fix is released. Review server logs for suspicious file deletion attempts, particularly targeting wp-config.php or .htaccess.

Hi! I’m here to help you understand CVE-2026-73033. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70