Arbitrary File Deletion

WordPress is vulnerable to arbitrary file deletion. The vulnerability can be triggered because the application does not check the filename inside the wp_delete_attachment function in wp-includes/post.php, allowing an attacker to input a malicious filename string via thumb parameter to cause arbitrary file deletion. This only works if the attacker has access permission for files and posts that are normally available only to the Author, Editor, and Administrator roles.