ThimPress WP Pipes Path Traversal Vulnerability Allowing Arbitrary File Deletion

A path traversal vulnerability has been identified in the ThimPress WP Pipes WordPress plugin, specifically in versions through 1.4.2. This vulnerability allows for improper limitation of pathname, enabling attackers to traverse directories and potentially delete arbitrary files from the server.

Impact

Exploitation of this vulnerability could lead to arbitrary file deletion on the affected WordPress site. Deleting core files could disrupt the site's functionality, causing it to break or stop working altogether.

Remediation

Users of the WP Pipes WordPress plugin should update to version 1.4.3 or later to address this vulnerability. Patchstack users can enable auto-updates for vulnerable plugins.