Description
The Support Board plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the sb_file_delete function in all versions up to, and including, 3.8.0. This makes it possible for attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). An attacker can leverage CVE-2025-4855 vulnerability to exploit this vulnerability unauthenticated.
Published: 2025-07-08
Score: 9.8 Critical
EPSS: 3.4% Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

The Support Board WordPress plugin contains an insufficient file path validation flaw in the sb_file_delete function that allows an unauthenticated attacker to delete arbitrary files on the server. This abuse can lead to remote code execution when critical files such as wp-config.php are removed, as the attacker can subsequently place malicious code.

Affected Systems

Affected systems include the Schiocco Support Board plugin for WordPress versions 3.8.0 and earlier. These versions run on any WordPress site that has the plugin installed and has not applied the latest security update.

Risk and Exploitability

This vulnerability has a CVSS score of 9.8 and an EPSS of 3%, indicating high severity and a moderate likelihood of exploitation. It is not currently listed in the CISA KEV catalog. Attackers can exploit this unauthenticated weakness using the sb_file_delete endpoint, or by chaining with the separate CVE-2025‑4855 vulnerability, giving them full control over files on the server.

Generated by OpenCVE AI on April 21, 2026 at 19:48 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update Support Board to the latest version (3.9 or later) where the path validation bug is fixed.
  • If an immediate update is not possible, disable the sb_file_delete functionality or restrict its access so that only authenticated administrators can use it.
  • Strengthen file system permissions so that the web server process cannot delete critical WordPress files such as wp-config.php or the entire content directory.
  • Consider deploying a file integrity monitoring solution to detect and alert on unexpected file deletions.

Generated by OpenCVE AI on April 21, 2026 at 19:48 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2025-20755 The Support Board plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the sb_file_delete function in all versions up to, and including, 3.8.0. This makes it possible for attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). An attacker can leverage CVE-2025-4855 vulnerability to exploit this vulnerability unauthenticated.
History

Mon, 14 Jul 2025 15:15:00 +0000

Type Values Removed Values Added
First Time appeared Schiocco
Schiocco support Board
CPEs cpe:2.3:a:schiocco:support_board:*:*:*:*:*:wordpress:*:*
Vendors & Products Schiocco
Schiocco support Board

Mon, 14 Jul 2025 13:45:00 +0000

Type Values Removed Values Added
Metrics epss

{'score': 0.00802}

 epss

{'score': 0.01053}

Wed, 09 Jul 2025 14:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 08 Jul 2025 23:30:00 +0000

Type Values Removed Values Added
Description The Support Board plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the sb_file_delete function in all versions up to, and including, 3.8.0. This makes it possible for attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). An attacker can leverage CVE-2025-4855 vulnerability to exploit this vulnerability unauthenticated.
Title Support Board <= 3.8.0 - Unauthenticated Arbitrary File Deletion
Weaknesses CWE-22
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Schiocco Support Board
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-04-08T16:45:31.136Z

Reserved: 2025-05-16T13:31:20.009Z

Link: CVE-2025-4828

cve-icon Vulnrichment

Updated: 2025-07-09T13:15:13.062Z

cve-icon NVD

Status : Analyzed

Published: 2025-07-09T00:15:47.077

Modified: 2025-07-14T15:14:26.103

Link: CVE-2025-4828

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-21T20:00:25Z

Weaknesses