Restrict File Access WordPress Plugin Cross-Site Request Forgery Vulnerability Allowing Arbitrary File Deletion

A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the Restrict File Access plugin for WordPress, affecting all versions through 1.1.2. The vulnerability arises from inadequate nonce validation on the 'restrict-file-access' page, enabling unauthenticated attackers to delete arbitrary files from the server. This file deletion could lead to remote code execution if a critical file, such as wp-config.php, is removed, especially if an administrator is tricked into initiating the action.

Impact

Exploitation of this vulnerability could result in unauthorized deletion of files on the server, potentially leading to remote code execution if a sensitive file is deleted.