Vulnerability · Published Aug 10, 2026 · Assigned by VulnCheck

CVE-2026-73033Sucuri WordPress Plugin 2.7.3 Path Traversal via integrity.lib.php

Medium 6.5

In plain English

A medium-severity path traversal in sucuri-wordpress-plugin from Sucuri. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 61% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.9%top 39.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Sucuri Security WordPress plugin through version 2.7.3 contains a path traversal vulnerability in the pageIntegritySubmission() method in src/integrity.lib.php that allows authenticated administrators to delete arbitrary files by supplying directory traversal sequences in the sucuriscan_integrity parameter. Attackers can manipulate the unsanitized file path concatenated with ABSPATH to traverse outside the WordPress installation directory and invoke unlink() on sensitive files such as wp-config.php and .htaccess, causing site outage or enabling malicious reinstallation.

Affected products (as reported)

Vendor	Product	Versions
Sucuri	sucuri-wordpress-plugin	0 – through 2.7.3

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H

References

Reseacher Disclosure technical-description, exploit, issue-tracking
https://www.vulncheck.com/advisories/sucuri-wordpress-plugin-path-traversal-via-integrity-lib-php third-party-advisory