CVE-2026-73033: Sucuri Security Path Traversal Flaw

CVE-2026-73033 Overview

CVE-2026-73033 is a path traversal vulnerability [CWE-22] in the Sucuri Security WordPress plugin through version 2.7.3. The flaw resides in the pageIntegritySubmission() method within src/integrity.lib.php. Authenticated administrators can supply directory traversal sequences in the sucuriscan_integrity parameter to delete arbitrary files outside the WordPress installation directory. The plugin concatenates the unsanitized input with ABSPATH and passes the resulting path to unlink(). Attackers can remove critical files such as wp-config.php and .htaccess, causing site outage or enabling a malicious reinstallation flow.

Critical Impact
An authenticated administrator can delete wp-config.php, triggering the WordPress installer and enabling site takeover through reconfiguration against an attacker-controlled database.

Affected Products

Sucuri Security WordPress plugin versions up to and including 2.7.3
WordPress installations where the plugin is active with administrator accounts exposed
Multisite WordPress deployments running the vulnerable plugin build

Discovery Timeline

2026-08-10 - CVE-2026-73033 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-73033

Vulnerability Analysis

The vulnerability is a classic path traversal issue in a privileged administrative code path. The pageIntegritySubmission() method processes the sucuriscan_integrity parameter without validating or normalizing the supplied file path. The plugin appends the attacker-controlled value to the ABSPATH constant and passes the concatenated string directly to PHP's unlink() function. Because no canonicalization occurs, sequences such as ../ allow the resolved path to escape the WordPress root.

While the operation requires an authenticated administrator, a compromised or rogue admin account can weaponize the endpoint to remove arbitrary files that the PHP process can access. Deleting wp-config.php is particularly impactful: WordPress detects the missing configuration and redirects visitors to the installation wizard, allowing an attacker to bind the site to a database they control.

Root Cause

The root cause is missing input sanitization on the sucuriscan_integrity request parameter. The vulnerable code performs no realpath resolution, no allowlist enforcement, and no check that the resulting path resides within ABSPATH. It also fails to restrict operations to files the plugin legitimately manages, such as core WordPress files identified by integrity scanning.

Attack Vector

Exploitation requires network access to the WordPress admin interface and a valid administrator session. The attacker submits a crafted request to the integrity submission handler with a sucuriscan_integrity value containing directory traversal sequences pointing at a sensitive file. The plugin executes unlink() against the resolved path, deleting the target. Technical details are documented in the VulnCheck Security Advisory and the corresponding GitHub Issue Discussion.

Detection Methods for CVE-2026-73033

Indicators of Compromise

HTTP POST requests to WordPress admin endpoints containing the sucuriscan_integrity parameter with ../ or URL-encoded traversal sequences such as %2e%2e%2f.
Unexpected deletion or absence of wp-config.php, .htaccess, or files outside the WordPress document root owned by the PHP process user.
WordPress serving the installation wizard (/wp-admin/install.php) on a previously provisioned site.

Detection Strategies

Inspect web server access logs for requests to wp-admin/admin.php?page=sucuriscan_integrity combined with parameter values containing traversal patterns.
Alert on unlink() calls or filesystem delete events targeting wp-config.php, .htaccess, and other files above ABSPATH from the PHP-FPM or web server process.
Monitor the Sucuri plugin's audit log for integrity submission events referencing paths that fall outside the WordPress core file set.

Monitoring Recommendations

Deploy file integrity monitoring on WordPress installation directories and adjacent paths containing configuration files.
Forward WordPress and web server logs to a centralized data lake for correlation between admin session activity and filesystem changes.
Track administrator logins and session activity for anomalies preceding integrity submission requests.

How to Mitigate CVE-2026-73033

Immediate Actions Required

Update the Sucuri Security WordPress plugin to a version later than 2.7.3 as soon as a fixed release is published by the vendor.
Audit WordPress administrator accounts, remove unused accounts, and enforce multi-factor authentication for all remaining admins.
Restrict access to /wp-admin/ by IP allowlist or VPN where operationally feasible until patching is complete.

Patch Information

At the time of publication, a vendor-supplied patched version has not been enumerated in the NVD entry. Track the GitHub Issue Discussion and the VulnCheck Security Advisory for the latest fixed version information and apply the plugin update through the WordPress admin dashboard or wp-cli.

Workarounds

Deactivate and remove the Sucuri Security plugin until a fixed version is released if administrator exposure cannot be reduced.
Configure a web application firewall rule to block requests to the integrity submission endpoint containing .., %2e%2e, or absolute paths in the sucuriscan_integrity parameter.
Set filesystem permissions so that the PHP process cannot delete wp-config.php and other files outside the plugin's expected scope.

bash

# Example WAF rule (ModSecurity syntax) to block traversal in the vulnerable parameter
SecRule ARGS:sucuriscan_integrity "@rx (\.\./|%2e%2e%2f|%2e%2e/)" \
    "id:1026073033,phase:2,deny,status:403,log,\
    msg:'CVE-2026-73033 Sucuri plugin path traversal attempt'"