LWS Cleaner WordPress Plugin Arbitrary File Deletion Vulnerability

A vulnerability allowing arbitrary file deletion has been identified in the LWS Cleaner plugin for WordPress, affecting all versions through 2.4.1.3. The issue arises from inadequate validation of file paths in the 'lws_cl_delete_file' function. This vulnerability enables authenticated attackers with Administrator-level access to delete arbitrary files on the server. Exploiting this flaw could lead to remote code execution, particularly if sensitive files like 'wp-config.php' are deleted.

Impact

Successful exploitation allows authenticated users with Administrator privileges to delete arbitrary files on the server, potentially leading to remote code execution.

Reproduction

To reproduce this vulnerability, an authenticated user with Administrator-level access can send a request to the 'lws_cl_delete_file' function. This request must include the path of the file to be deleted. The lack of proper path validation allows for traversal and deletion of files outside the intended directory, including critical WordPress files.

Remediation

Users are advised to update the LWS Cleaner plugin to version 2.4.2 or later.