Presto Player Pro
Monthly
Arbitrary file deletion in the WordPress plugin Presto Player Pro (versions 3.0.1 and earlier) lets an authenticated account with at least Author-level privileges supply a traversal path to a plugin file-handling function and delete files outside the intended scope, including files elsewhere in the WordPress installation. Patchstack scores it CVSS 6.8 with high availability impact and no confidentiality or integrity impact, and no publicly available exploit code or active exploitation was identified at time of analysis. The realistic exposure is gated by the privilege requirement: sites that do not host untrusted Author accounts or allow open author-tier self-registration are substantially less exposed.
Arbitrary file deletion in the WordPress plugin Presto Player Pro (versions 3.0.1 and earlier) lets an authenticated account with at least Author-level privileges supply a traversal path to a plugin file-handling function and delete files outside the intended scope, including files elsewhere in the WordPress installation. Patchstack scores it CVSS 6.8 with high availability impact and no confidentiality or integrity impact, and no publicly available exploit code or active exploitation was identified at time of analysis. The realistic exposure is gated by the privilege requirement: sites that do not host untrusted Author accounts or allow open author-tier self-registration are substantially less exposed.