Path traversal can occur in the pageIntegritySubmission() method when an authenticated administrator supplies directory traversal sequences in the sucuriscan_integrity parameter. The unsanitized file path is concatenated with ABSPATH, allowing the attacker to reference files outside the WordPress installation directory and delete them with PHP unlink(), potentially targeting wp-config.php or .htaccess. The vulnerability is a classic directory traversal flaw, classified as CWE‑22, and may lead to site outage or enable malicious reinstallation by an admin user.

The Sucuri Security WordPress plugin, version 2.7.3 and earlier, on any WordPress site that includes this plugin installation. The issue affects the plugin’s handling of the integrity check feature where administrators can trigger arbitrary file deletion. WordPress installations that have the plugin installed and an authenticated administrator account are therefore affected.

The CVSS score of 7 indicates a high severity, meaning the flaw poses a serious risk when exploited. The EPSS score is not available, but the lack of listing in the CISA KEV catalog suggests no publicly known exploit has emerged yet. The most likely attack vector requires a user with administrator privileges, so the threat is limited to sites with active admin accounts that can be compromised through other means or social engineering. Once the vulnerability is exploited, arbitrary file deletion can disrupt site operations or allow a malicious administrator to replace core files.