Database Toolset Plugin Arbitrary File Deletion Vulnerability

A vulnerability allowing arbitrary file deletion has been identified in the Database Toolset WordPress plugin, affecting all versions through 1.8.4. This issue arises from inadequate validation of file paths, enabling unauthenticated attackers to delete arbitrary files on the server. Such deletions could lead to remote code execution, particularly if critical files like wp-config.php are removed.

Impact

Exploitation of this vulnerability allows for unauthenticated arbitrary file deletion, which could be leveraged to execute remote code, especially if a sensitive file is deleted.

Remediation

No known patch is available. It is recommended to uninstall the affected plugin and consider a replacement.