TL;DR: The Sucuri Security WordPress plugin through version 2.7.3 contains a path traversal vulnerability in its file integrity scanner. An authenticated administrator can supply directory traversal sequences in the sucuriscan_integrity parameter to delete arbitrary files outside the WordPress installation directory, including wp-config.php and .htaccess. This causes site outage and opens the door to malicious reinstalls. Upgrade to version 2.7.4 or later.

Why this matters for the WordPress ecosystem

Sucuri Security is one of the most widely installed security plugins on WordPress. The WordPress.org plugin directory reports 600,000+ active installations and 36 million all-time downloads. It ranks in the top 120 plugins across the entire WordPress ecosystem. Site owners install Sucuri specifically to protect against malware, brute force, and unauthorized file modifications. A path traversal vulnerability inside a security tool creates a particularly sharp irony: the plugin you installed to detect tampered files can itself be used to delete critical WordPress files.

WordPress powers approximately 43% of all websites on the internet. A vulnerability in a plugin with 600,000 active installs has a blast radius that exceeds most standalone applications. Even one tenth of one percent of affected sites experiencing exploitation would impact hundreds of installations.

What happened

The vulnerability is in the pageIntegritySubmission() method inside src/integrity.lib.php. This method receives the sucuriscan_integrity parameter from an administrator request, concatenates it with the WordPress ABSPATH constant, and passes the result to PHP's unlink() function. The code does not normalize or validate the parameter before the filesystem operation.

An attacker who has administrator credentials sends a request to the plugin's integrity scanner endpoint with a payload like ../../wp-config.php in the sucuriscan_integrity field. PHP resolves the path relative to the WordPress root, climbs above the installation directory, and deletes the target file. The same technique works against .htaccess, which controls rewrite rules and access restrictions, and against any other file accessible to the web server process.

This is a path traversal vulnerability classified under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). The exploit requires authenticated administrator access, which limits the direct attack surface. But the impact is severe: deleting wp-config.php takes the entire WordPress site offline and exposes database credentials in a way that enables full site takeover during reinstallation.

Who is affected

All sites running Sucuri Security plugin versions through 2.7.3 are affected. The plugin is available on the WordPress.org plugin directory and has been on the directory since 2011 with 116 releases. Version 2.7.3 and earlier are vulnerable.

The plugin scans file integrity, blocks brute force attempts, manages WordPress hardening, and performs malware scanning. Administrators trust it with filesystem access. Organizations using Sucuri Security include enterprise WordPress deployments, ecommerce stores, government agencies, and media publishers.

NVD data for this CVE was not available at the time of writing. The CVE was published through the CVE List V5 source.

What to do

1. Update to version 2.7.4. The WordPress.org plugin directory shows version 2.7.4 as the current release, dated July 7, 2026. Log in to your WordPress admin dashboard, navigate to Plugins, and click "Update Now" on Sucuri Security. Or download the new version directly: https://downloads.wordpress.org/plugin/sucuri-scanner.2.7.4.zip
2. Verify file integrity. After updating, scan your WordPress installation for unexpected file modifications. Check that wp-config.php and .htaccess contain their expected content. Run wp core verify-checksums via WP-CLI to confirm no core files were tampered with.
3. Review administrator accounts. The exploit requires administrator credentials. Audit your admin user list for unauthorized or dormant accounts. Force a password reset for all administrators if you suspect compromise.
4. Restrict plugin file access. On managed hosting or VPS deployments, set filesystem permissions so the web server user can write only to wp-content/uploads and the Sucuri cache directory. Deny write access to wp-config.php and .htaccess at the OS level using chmod 444 wp-config.php.

Why it matters

Security plugins occupy a privileged position in the WordPress trust model. They typically request broad filesystem access to perform malware scanning, file integrity checks, and hardening operations. When a security plugin contains a filesystem vulnerability, the tool designed to protect the site becomes the tool that breaks it. Administrator credentials in WordPress are frequently compromised through cookie theft, session hijacking, and credential stuffing. An attacker who gains admin access does not just deface the site. They can now delete the configuration file that holds database salts and authentication keys, forcing a site reinstall where they can inject their own credentials.

The Sucuri plugin has 600,000 active installations. Any deployment still on 2.7.3 or earlier should update immediately.

References

• HOL Guard: https://hol.org/guard/security/cves/CVE-2026-73033
• WordPress.org plugin page: https://wordpress.org/plugins/sucuri-scanner/
• Download v2.7.4: https://downloads.wordpress.org/plugin/sucuri-scanner.2.7.4.zip