VibeThemes WPLMS Plugin Path Traversal Vulnerability Allowing Arbitrary File Deletion

A path traversal vulnerability has been identified in the VibeThemes WPLMS plugin, specifically in versions through 1.9.9.5.4. This vulnerability allows for improper limitation of a pathname, enabling arbitrary file deletion on the affected WordPress sites.

Impact

Exploitation of this vulnerability could lead to arbitrary file deletion, allowing malicious actors to remove files from the website. Deleting core files could disrupt the site's functionality, causing it to break or stop working altogether.

Remediation

Users are advised to update to a version of the VibeThemes WPLMS plugin that is not vulnerable. Patchstack has issued a mitigation rule to block attacks targeting this vulnerability until an official fix is available.