CVE-2026-73033 is a path traversal vulnerability in the Sucuri Security WordPress plugin versions up to 2.7.3. The flaw exists in the pageIntegritySubmission() method within src/integrity.lib.php, where the sucuriscan_integrity parameter is not properly sanitized. Authenticated administrators can supply directory traversal sequences that manipulate the file path concatenated with ABSPATH, allowing unlink() to delete arbitrary files outside the WordPress installation directory. This can lead to site outages or enable attackers to reinstall malicious content.

An authenticated administrator can exploit this vulnerability to delete arbitrary files on the server, including critical configuration files such as wp-config.php and .htaccess. This can result in site downtime or enable attackers to compromise the site by reinstalling malicious code. The CVSS 4.0 score is 7.0 (high severity), reflecting the potential for significant impact when exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrator access to trusted users only and monitor for suspicious activity related to file deletions via the plugin. Avoid using versions up to 2.7.3 in production environments if possible.