CVE-2026-27040
Published: 25 March 2026
Summary
CVE-2026-27040 is a high-severity Path Traversal (CWE-22) vulnerability. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique File Deletion (T1070.004); ranked at the 18.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly remediates the specific path traversal flaw in the WZone plugin, preventing arbitrary file deletion by low-privileged attackers.
Validates file path inputs to block traversal sequences like '../', directly countering CWE-22 exploitation in the plugin.
Enforces access controls on system resources, limiting damage from successful path traversal by denying unauthorized file deletions.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Path traversal (CWE-22) directly enables authenticated arbitrary file deletion, mapping to T1070.004 (File Deletion under Indicator Removal) and T1485 (Data Destruction) for availability/integrity impact.
NVD Description
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in AA-Team WZone woozone allows Path Traversal.This issue affects WZone: from n/a through <= 14.0.31.
Deeper analysisAI
CVE-2026-27040 is an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability, classified under CWE-22, in the AA-Team WZone Woozone WordPress plugin. This issue affects WZone versions from n/a through 14.0.31 and was published on 2026-03-25.
The vulnerability carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity. A low-privileged authenticated attacker can exploit it remotely with low complexity and no user interaction, achieving high impacts on confidentiality, integrity, and availability, including arbitrary file deletion.
The Patchstack advisory provides further details on this arbitrary file deletion vulnerability in the WZone plugin version 14.0.31: https://patchstack.com/database/Wordpress/Plugin/woozone/vulnerability/wordpress-wzone-plugin-14-0-31-arbitrary-file-deletion-vulnerability?_s_id=cve.
Details
- CWE(s)