CVE-2026-39752

Summary

The flaw allows authenticated contributors to delete arbitrary files on the WordPress server by manipulating job parameters, potentially leading to remote code execution or data loss. This affects WordPress versions up to 2.8.2.

Exploitability

Exploitation requires an authenticated contributor account with access to job management features, making it moderately difficult but possible for attackers who can compromise such accounts.

Blast radius

If exploited, this vulnerability could allow attackers to delete critical application files, configuration files, or uploaded media, potentially leading to complete site compromise or service disruption.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to WordPress version 2.8.3 or later to remediate this arbitrary file deletion vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.