Icons Factory WordPress Plugin Arbitrary File Deletion Vulnerability

A vulnerability allowing arbitrary file deletion has been identified in the Icons Factory plugin for WordPress, affecting all versions through 1.6.12. The issue arises from inadequate authorization and improper path validation in the delete_files() function, enabling unauthenticated attackers to delete arbitrary files on the server. This vulnerability could easily lead to remote code execution if a critical file, such as wp-config.php, is deleted.

Impact

Exploitation of this vulnerability could result in unauthorized deletion of files on the server, potentially leading to remote code execution if a sensitive file is removed.

Reproduction

The vulnerability can be reproduced by sending a POST request to the WordPress site with the action key set to 'delete_files' and including the paths of the files to be deleted. This can be done without authentication, taking advantage of the plugin's lack of proper authorization checks.

Remediation

No known patch is available. It is recommended to uninstall the affected plugin and consider a replacement.