Somatic Framework WordPress Plugin Arbitrary File Deletion Vulnerability

The Somatic Framework WordPress plugin through 1.8.14 has a missing authorization and arbitrary file deletion vulnerability.

It does not perform an authorization check or validate a user-supplied file path before deleting it, allowing any authenticated user to delete arbitrary files on the server.

• Affected: Somatic Framework versions through 1.8.14
• Privilege required: any authenticated user, including subscribers
• Impact: arbitrary file deletion, which can lead to full site takeover