CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
What the vulnerability does
The Data Tables Generator by Supsystic plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the cleanCache() function in all versions up to, and including, 1.10.45. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
Explanation of Vulnerability in Simple Terms
Data Tables Generator by Supsystic versions up to 1.10.45 contain a path traversal vulnerability that allows high-privilege users to read, write, or delete files on the server outside the intended directory. An attacker with administrative access can manipulate file paths to access sensitive system files or overwrite critical application files, compromising site integrity and availability.
What an attacker can do
Read, write, or delete files outside the intended directory on the server.
Potential impact on your site
A compromised admin account can be used to access sensitive files, modify core files, or disable the site.
Conditions required to exploit
Attacker must have high-level administrative privileges on the site.
Key dates
External resources
