{"id":"CVE-2026-19253","published":"2026-10-01T06:17:08.467","lastModified":"2026-10-01T13:11:52.923","description":"The Cache Enabler WordPress plugin before 1.8.17 does not validate a URL before using it to build a filesystem path in its cache purge routine, and does not confine the resulting deletion to the cache directory, allowing unauthenticated users to delete arbitrary files and directories on sites where another installed Cache Enabler WordPress plugin before 1.8.17 or  passes a request-derived URL to its public cache-clearing hook.","cvssScore":8.7,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H","cwes":["CWE-73"],"vendors":[],"products":[],"references":[{"url":"https://wpscan.com/vulnerability/49ecffb5-26ae-43e5-9942-e2d63970b39d/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The flaw allows unauthenticated users to delete arbitrary files and directories by manipulating a URL in the Cache Enabler WordPress plugin, posing a significant security risk.","exploitability":"Exploitation is relatively straightforward given the lack of URL validation and confinement checks, requiring only that a request-derived URL be passed to the public cache-clearing hook.","blast_radius":"If exploited, this could lead to the complete compromise of the affected WordPress site, including the deletion of critical files and directories.","remediation":"Upgrade to Cache Enabler version 1.8.17 or later.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["web","wp-plugin","file-deletion"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-10-03T08:55:36.899Z"}}