WordPress Attachment Manager Plugin Arbitrary File Deletion Vulnerability

A vulnerability allowing arbitrary file deletion has been identified in the Attachment Manager plugin for WordPress, affecting all versions through 2.1.2. The issue arises from inadequate file path validation in the handle_actions() function, enabling unauthenticated attackers to delete arbitrary files on the server. This vulnerability could easily lead to remote code execution if critical files, such as wp-config.php, are deleted.

Impact

Exploitation of this vulnerability allows for unauthenticated arbitrary file deletion on the server. Deleting certain files, like wp-config.php, could lead to remote code execution.