Sucuri Security, one of the most widely installed WordPress security and malware-scanning plugins, shipped version 2.7.4 this month to fix a path traversal vulnerability tracked as CVE-2026-73033. The Sucuri Security plugin vulnerability was published to the National Vulnerability Database on August 10, 2026, and affects every version up to and including 2.7.3.
What the Sucuri Security plugin vulnerability actually does
The bug lives in the pageIntegritySubmission() method inside src/integrity.lib.php, part of the plugin’s file integrity checker. That code accepts a sucuriscan_integrity parameter and concatenates it directly with the site’s ABSPATH without sanitizing it first. An authenticated administrator, or an attacker who has already gained admin-level access some other way, can supply directory traversal sequences like ../ in that parameter and get the plugin to call unlink() on files sitting outside the WordPress install, including wp-config.php or .htaccess.
It’s rated 6.5 (Medium) under CVSS 3.1 and 7.0 (High) under the newer CVSS 4.0 scoring, filed under CWE-22 for improper limitation of a pathname to a restricted directory. Because it needs high privileges to trigger, it’s not something a random site visitor can pull off directly. Where it actually bites is the scenario a lot of agencies deal with day to day: a client site with several admin accounts, one compromised admin credential, or a separate plugin vulnerability that already handed someone admin access and is now looking for a way to do real damage. Deleting wp-config.php or .htaccess is a fast way to take a site fully offline or set up a malicious reinstall.
What to do about it
If a site you manage is running Sucuri Security 2.7.3 or earlier, update to 2.7.4 or later. It’s a routine plugin update with nothing unusual reported about it. Worth pairing with a quick check on who actually holds administrator access on the site, since that’s the privilege level this bug depends on to be exploitable at all.
It’s also a reasonable prompt to have someone actually review plugin permissions and admin accounts rather than assume a security plugin is quietly handling everything in the background. That kind of review is part of what we look at during a WordPress development engagement when we take over maintenance on an existing site. If the site also needs the core update we covered earlier this week, this is a good time to clear both at once.
