CVE-2026-66481

Received Received - Intake

Author Arbitrary File Deletion in Presto Player Pro

Publication date: 2026-10-10

Last updated on: 2026-10-10

Assigner: Patchstack

Description

Author Arbitrary File Deletion in Presto Player Pro <= 3.0.1 versions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-10

Last Modified

2026-10-10

Generated

2026-10-11

AI Q&A

2026-10-11

EPSS Evaluated

N/A

NVD

CVE-2026-66481

EUVD

EUVD-2026-96514

Affected Vendors & Products

Vendor	Product	Version / Range
Presto	Player	Presto Player Pro n/a

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

This vulnerability is an arbitrary file deletion flaw in the Presto Player Pro WordPress plugin versions 3.0.1 and below. It allows attackers to delete critical files on a website, potentially disrupting its functionality. The issue falls under Broken Access Control in the OWASP Top 10.

Detection Guidance

Check if the Presto Player Pro plugin version is 3.0.1 or below. Look for suspicious file deletion activities in server logs. Use commands like 'grep -r "Presto Player Pro" /var/www/' to identify vulnerable installations.

Impact Analysis

Attackers could exploit this to delete important website files, causing downtime or data loss. Websites using vulnerable versions may face disruptions, and sensitive data could be compromised if critical files are removed.

Mitigation Strategies

Update the Presto Player Pro plugin to version 3.0.2 or later immediately. If updating is not possible, apply the Patchstack mitigation rule to block attacks until the update is applied.

Hi! I’m here to help you understand CVE-2026-66481. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70