Webo Mcp
Monthly
Arbitrary file deletion in the WEBO MCP WordPress plugin (versions 3.0.18 and earlier) allows authenticated attackers with at least the Author role to delete files on the server, causing availability impact. The vulnerability is a path traversal (CWE-22) that requires a valid content-creator account but no user interaction, and it has a scope change affecting resources outside the plugin. No public exploit code has been identified at time of analysis, and the CVSS base score is 6.8 (Medium).
Arbitrary file deletion in the WEBO MCP WordPress plugin (versions 3.0.18 and earlier) allows authenticated attackers with at least the Author role to delete files on the server, causing availability impact. The vulnerability is a path traversal (CWE-22) that requires a valid content-creator account but no user interaction, and it has a scope change affecting resources outside the plugin. No public exploit code has been identified at time of analysis, and the CVSS base score is 6.8 (Medium).