Description
WordPress is prone to a vulnerability that lets attackers delete arbitrary files because the application fails to properly verify user-supplied input. An attacker can exploit this vulnerability to delete arbitrary files in the context of the webserver process, rendering the website unusable, or even to execute arbitrary code on the webserver. WordPress versions 4.9.x ranging from 4.9 and up to (and including) 4.9.6 are vulnerable.
Remediation
Update to WordPress version 4.9.7 or latest
References
https://blog.ripstech.com/2018/wordpress-file-delete-to-code-execution/
http://blog.vulnspy.com/2018/06/27/Wordpress-4-9-6-Arbitrary-File-Delection-Vulnerbility-Exploit/
https://www.exploit-db.com/exploits/44949/
https://packetstormsecurity.com/files/148333/WordPress-4.9.6-Arbitrary-File-Deletion.html
http://blog.nsfocus.net/wordpress-delete-any-file/
https://wordpress.org/news/2018/07/wordpress-4-9-7-security-and-maintenance-release/
Related Vulnerabilities
WordPress Plugin Page Builder:PageLayer-Drag and Drop website builder Cross-Site Scripting (1.3.4)
WordPress Plugin Affiliates Multiple Cross-Site Scripting Vulnerabilities (2.13.1)
Oracle Application Server Other Vulnerability (CVE-2007-3863)
Artifactory Insufficiently Protected Credentials Vulnerability (CVE-2020-2165)
Oracle Database Server CVE-2011-2253 Vulnerability (CVE-2011-2253)