Critical · published January 13, 2026
🚨 An unauthenticated attacker can delete any file on your server with just a crafty request — that’s like handing the keys to the janitor and asking them to clean out the files you’d rather keep! 🔥 Imagine a restaurant where anyone can sneak into the kitchen and toss out the secret recipes — that’s what this vulnerability does to your server's files! Without proper file path validation, the plugin can’t tell which files are safe to delete and which ones are critical to your site’s operation. An attacker could walk in and obliterate anything they choose — deleting essential files could bring your site to its knees, result in loss of sensitive data, or even compromise your entire application. This is absolutely devastating for any WordPress site using this plugin.
Imagine a restaurant where anyone can sneak into the kitchen and toss out the secret recipes — that’s what this vulnerability does to your server's files! Without proper file path validation, the plugin can’t tell which files are safe to delete and which ones are critical to your site’s operation. The E-xact | Hosted Payment | WordPress plugin version 2.0 lacks sufficient file path validation, allowing unauthenticated attackers to exploit this flaw and delete arbitrary files on the server without proper authorization.
An attacker could walk in and obliterate anything they choose — deleting essential files could bring your site to its knees, result in loss of sensitive data, or even compromise your entire application. This is absolutely devastating for any WordPress site using this plugin. Update the E-xact | Hosted Payment plugin to the latest version immediately to close this critical vulnerability. Implement strict file path validation and regularly audit your server for unauthorized access. Don't let those nasty intruders in! You've got this! Follow these steps and lock down your site like the hero you are! 🛡️