CVE-2026-73033: Sucuri WordPress Plugin 2.7.3 Path Traversal via integrity.lib.php

Published Aug 10, 2026
·
Updated

Sucuri Security WordPress plugin through version 2.7.3 contains a path traversal vulnerability in the pageIntegritySubmission() method in src/integrity.lib.php that allows authenticated administrators to delete arbitrary files by supplying directory traversal sequences in the sucuriscanintegrity parameter. Attackers can manipulate the unsanitized file path concatenated with ABSPATH to traverse outside the WordPress installation directory and invoke unlink() on sensitive files such as wp-config.php and .htaccess, causing site outage or enabling malicious reinstallation.

Affected Software

1 affected component
Sucuri WordPress plugin (Sucuri Security)<=2.7.3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade Sucuri Security WordPress plugin to a version that resolves this vulnerability.

    Fixed in 2.7.3Patch Sucuri WordPress Plugin 2.7.3 Path Traversal via integrity.lib.php
  2. Configuration

    Remove/avoid use of the sucuriscan_integrity parameter value that contains directory traversal sequences, since it can be used to delete arbitrary files via the pageIntegritySubmission() method in src/integrity.lib.php.

    WordPress (Sucuri Security WordPress plugin) sucuriscan_integrity = Do not allow directory traversal sequences (e.g., ../)
  3. Operational

    Check whether any sensitive files (e.g., wp-config.php and .htaccess) were deleted due to the vulnerability, restore them from backups, and verify site integrity after remediation.

Event History

Aug 10, 2026
CVE Published
via MITRE·08:15 PM
Data Sourced
via MITRE·08:15 PM
DescriptionSeverityWeakness
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of CVE-2026-73033?

CVE-2026-73033 has a medium severity rating of 6.5.

2

How do I fix CVE-2026-73033?

To fix CVE-2026-73033, update the Sucuri Security WordPress plugin to version 2.7.4 or later.

3

What type of vulnerability is CVE-2026-73033?

CVE-2026-73033 is a path traversal vulnerability.

4

Who is affected by CVE-2026-73033?

Authenticated administrators using Sucuri Security WordPress plugin versions prior to 2.7.4 are affected by CVE-2026-73033.

5

What can attackers do with CVE-2026-73033?

Attackers can exploit CVE-2026-73033 to delete arbitrary files on the server by using directory traversal sequences.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203
CVE-2026-73033 - Sucuri WordPress Plugin 2.7.3 Path Traversal via integrity.lib.php - SecAlerts