{
 "id": "WPSEC-2026-1322",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1322/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1322/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1322/index.md",
 "title": "Easy Testimonial Slider and Form <= 1.0.31 - Unauthenticated Path Traversal to Arbitrary File Deletion via 'oldcaptcha' Parameter",
 "description": "The Easy Testimonial Slider and Form plugin for WordPress is vulnerable to path traversal leading to arbitrary file deletion via the 'oldcaptcha' parameter of the etr_get_new_captcha AJAX action in all versions up to, and including, 1.0.31. The plugin passes the user-supplied captcha name to unlink() without checking it, after appending only a '.jpeg' or '.txt' extension. The action is registered for unauthenticated users. Its only protection is a nonce that the [print_best_testimonial_form] shortcode prints on the front end. This makes it possible for unauthenticated attackers to delete arbitrary .jpeg and .txt files that the web server can write, such as media library images, on sites that display the testimonial form.",
 "plugin": {
  "slug": "easy-testimonial-rotator",
  "name": "Easy Testimonial Slider and Form",
  "full_name": "Easy Testimonial Slider and Form",
  "wordpress_org": "https://wordpress.org/plugins/easy-testimonial-rotator/",
  "advisories_url": "https://wpsec.com/vuln/plugin/easy-testimonial-rotator/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/easy-testimonial-rotator"
 },
 "type": "FILE DELETION",
 "cwe": [
  "CWE-22"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 8.2,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L",
  "severity": "High"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "1.0.32",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 1.0.32"
  ]
 },
 "introduced_in": null,
 "fixed_in": "1.0.32",
 "remediation": "Update to 1.0.32 or later.",
 "fix_released": "2026-10-20T07:10:08+00:00",
 "published": "2026-10-21T10:43:36+00:00",
 "updated": "2026-10-21T10:36:22.857351+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1322/",
  "https://plugins.svn.wordpress.org/easy-testimonial-rotator/tags/1.0.32/",
  "https://wordpress.org/plugins/easy-testimonial-rotator/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/easy-testimonial-rotator",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-10-21"
 }
}