CVE-2026-52716: WorkScout-Core Path Traversal Flaw

CVE-2026-52716 Overview

CVE-2026-52716 is an unauthenticated arbitrary file deletion vulnerability affecting the WorkScout-Core WordPress plugin in versions up to and including 1.7.11. The flaw is categorized as a path traversal weakness [CWE-22], allowing remote attackers to delete files on the underlying server without authentication. Successful exploitation can corrupt site functionality, remove critical configuration files such as wp-config.php, and in some scenarios enable site takeover when WordPress enters its setup state after the configuration file is removed.

Critical Impact
Remote, unauthenticated attackers can delete arbitrary files on WordPress sites running vulnerable WorkScout-Core versions, leading to integrity and availability impact.

Affected Products

WorkScout-Core WordPress plugin versions <= 1.7.11
WordPress sites using the WorkScout theme ecosystem that bundles WorkScout-Core
Any deployment exposing the vulnerable plugin endpoints to network requests

Discovery Timeline

2026-06-17 - CVE-2026-52716 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-52716

Vulnerability Analysis

The vulnerability is a path traversal flaw [CWE-22] that allows an unauthenticated attacker to influence a file path parameter processed by WorkScout-Core. The plugin accepts a user-supplied filename or path and passes it to a file deletion routine without enforcing that the resolved path stays within an expected directory. Because no authentication or capability check guards the affected entry point, any remote actor can invoke the deletion logic over the network.

The impact is bounded by the file system permissions of the PHP process running WordPress. On typical shared hosting and many self-managed deployments, that process owns the WordPress installation, which places core files, plugin files, and configuration data within reach of the attacker.

Root Cause

The root cause is insufficient validation and canonicalization of a path input. The affected code does not constrain the target to a fixed base directory and does not reject traversal sequences such as ../. Combined with the lack of an authentication or nonce check, this allows external requests to drive the file deletion operation.

Attack Vector

Exploitation occurs over the network against a publicly reachable WordPress site. The attacker issues an HTTP request to the vulnerable WorkScout-Core endpoint and supplies a crafted relative path that escapes the intended directory. No user interaction or prior credentials are required. Refer to the Patchstack WordPress Vulnerability Report for additional technical context.

Detection Methods for CVE-2026-52716

Indicators of Compromise

Unexpected deletion of WordPress core, plugin, or theme files, particularly wp-config.php, .htaccess, or files under wp-content/
HTTP requests to WorkScout-Core plugin endpoints containing traversal sequences such as ../, ..%2f, or absolute paths
WordPress returning the installation or setup screen after a previously functional site becomes unavailable
PHP error logs showing unlink() calls on paths outside the plugin's working directory

Detection Strategies

Inspect web server access logs for POST or GET requests targeting WorkScout-Core handlers with suspicious file, path, or filename parameters
Deploy web application firewall rules that block path traversal patterns in requests to /wp-admin/admin-ajax.php and plugin-specific endpoints
Run file integrity monitoring on the WordPress document root to alert on deletions of tracked files
Correlate unauthenticated requests to the plugin with subsequent file system change events

Monitoring Recommendations

Enable verbose logging on the WordPress instance and forward logs to a centralized analytics platform for correlation
Alert on any modification or deletion of wp-config.php, .htaccess, and active plugin files
Track HTTP 200 responses to plugin AJAX endpoints from unauthenticated sessions and review traffic baselines

How to Mitigate CVE-2026-52716

Immediate Actions Required

Identify all WordPress sites running WorkScout-Core and confirm the installed version against 1.7.11
Update WorkScout-Core to a fixed release as published by the vendor once available
Temporarily deactivate the plugin if a patched version is not yet installed and the site is internet-facing
Restore any deleted files from a known-good backup and rotate WordPress secrets if wp-config.php was exposed or removed

Patch Information

A fixed version of WorkScout-Core resolves the path traversal flaw by validating and constraining file paths before deletion. Administrators should consult the Patchstack WordPress Vulnerability Report for the latest patched version and apply it through the WordPress admin update mechanism or by replacing the plugin directory.

Workarounds

Block external access to the vulnerable AJAX or REST endpoints exposed by WorkScout-Core using web server rules
Deploy a web application firewall signature that rejects path traversal patterns (..%2f, ..\\, encoded variants) in plugin parameters
Restrict file system permissions so the PHP user cannot delete files outside wp-content/uploads/ where feasible
Maintain offline backups of wp-config.php and the WordPress installation to enable rapid recovery

bash

# Example WAF rule pattern (ModSecurity) to block traversal in plugin requests
SecRule REQUEST_URI "@contains workscout" \
    "chain,deny,status:403,id:1052716,msg:'WorkScout-Core path traversal attempt'"
    SecRule ARGS "@rx (\.\./|\.\.%2f|\.\.\\\\)" "t:lowercase,t:urlDecodeUni"