What is CVE-2026-73033?
The Sucuri Security WordPress plugin up to version 2.7.3 contains a path traversal vulnerability in the pageIntegritySubmission() method within src/integrity.lib.php. Authenticated administrators can delete arbitrary files on the server by supplying directory traversal sequences via the vulnerable parameter. Immediate update to the latest version is strongly recommended.
Azərbaycanca: Sucuri Security WordPress plaqini 2.7.3-ə qədər versiyalarda pageIntegritySubmission() metodunda path traversal zəifliyi aşkarlanıb. Bu, autentifikasiya olunmuş administratorlara kataloq keçidi ardıcıllıqlarından istifadə edərək serverdə ixtiyari faylları silməyə imkan verir. Plaqini dərhal ən son versiyaya yeniləmək tövsiyə olunur.
Related CVEs
link basis: same weakness class CWE-22
FAQ2
What privileges must an attacker have to exploit CVE-2026-73033 in the Sucuri Security WordPress plugin?
The attacker must be an authenticated administrator.
In which method of the Sucuri Security plugin does CVE-2026-73033 exist?
The vulnerability exists in the pageIntegritySubmission() method within src/integrity.lib.php.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.