Threats tagged 'ghsa-9367-hx9q-rjcg'

The Optimole WordPress plugin up to version 4.2.19 contains a vulnerability that allows unauthenticated attackers to delete arbitrary files on the server due to insufficient file path validation. Exploitation requires the presence of PEAR's Archive_Tar library and an administrator to perform a rename action on an attachment after the attacker stages a malicious payload. This can lead to remote code execution if critical files like wp-config.php are deleted. The vulnerability has a high severity score of 7.1 and requires user interaction by an administrator to be exploited.