Flexcubed PitchPrint Path Traversal Vulnerability Allowing Arbitrary File Deletion

A path traversal vulnerability has been identified in the Flexcubed PitchPrint WordPress plugin, affecting versions through 11.1.2. This vulnerability allows for improper limitation of a pathname, potentially leading to arbitrary file deletion on the affected website.

Impact

Exploitation of this vulnerability could result in the deletion of files from the website, including core files, which could disrupt the site's functionality.

Remediation

Users of the Flexcubed PitchPrint WordPress plugin should update to version 11.2.0 or later to address this vulnerability. Patchstack users can enable auto-update for vulnerable plugins.