Critical · published November 18, 2022
🚨 An unauthenticated attacker can delete any file they like through the WatchTowerHQ plugin! 🔥 Think of this as a mischievous visitor at a library who can walk in and toss any book they want into the trash, without needing a library card. It’s like having a front desk that doesn’t verify who you are before letting you loose in the archives! If exploited, an attacker could wipe critical files from your WordPress installation, leading to devastating data loss or even complete shutdown of your site. This could compromise your web presence and user trust in an instant, making it urgent to act!
Think of this as a mischievous visitor at a library who can walk in and toss any book they want into the trash, without needing a library card. It’s like having a front desk that doesn’t verify who you are before letting you loose in the archives! This vulnerability in the WatchTowerHQ plugin version 3.6.15 and below allows unauthenticated users to send requests that delete arbitrary files on the server, posing a grave risk to the integrity of the website.
If exploited, an attacker could wipe critical files from your WordPress installation, leading to devastating data loss or even complete shutdown of your site. This could compromise your web presence and user trust in an instant, making it urgent to act! Update the WatchTowerHQ plugin immediately to version 3.6.16 or higher. Additionally, consider enhancing your security settings by implementing file permissions that restrict file deletions and conducting a full site audit for any signs of compromise. You've got this! Follow these steps and you'll have your WordPress site secured in no time! 🛡️