ID:7045 - Exploit for Arbitrary file deletion in WordPress - CVE-2018-12895

Link to public exploit:

Vulnerability description

The vulnerability allows a remote authenticated user to delete arbitrary file on the system.

The vulnerability exists due to improper check for user permissions when deleting files. A remote authenticated user with ability to manage media files can send a specially crafted HTTP request and delete arbitrary file on the server.

Remediation