CVE-2026-16585

The CVSS 7.2 rating for CVE-2026-16585 materially understates the risk by treating the administrator-authentication requirement as a meaningful security boundary. In WordPress deployments—and particularly in shared hosting environments, which represent a large share of WordPress installations—admin access frequently equates to filesystem write capability through theme/plugin editors, wp-content directories, or legitimate admin features that execute PHP. The authentication gate filters for targets where the attacker already has substantial control, not for a meaningful security checkpoint. The more critical factor is the stored-traversal mechanism. The vulnerable delete_sticker function reads a traversal payload from WordPress options that persists until manually purged from the database. This transforms the vulnerability from a one-shot exploitation window into a persistent access mechanism. An attacker with admin credentials can delete .htaccess files to disable protection, remove security plugins during low-coverage periods, or delete wp-config.php to force a reinstall and capture fresh database credentials. The exploitation can occur across multiple requests over weeks—the CVSS temporal model has no axis for low-and-slow, patience-based attacks, but this is precisely the attacker calculus here. The EPSS score of 0.00734 reflects observed exploitation frequency, not potential impact. For unmanaged WordPress deployments with this plugin, the actual likelihood of exploitation is substantially higher because the exploitation path requires no zero-day research—just the documented traversal bypass. Do not treat EPSS as a severity indicator for this vulnerability class. Patch quality warrants scrutiny. When developers fix path traversal vulnerabilities, they frequently introduce new issues: race conditions between path normalization and file operations, or symlink bypasses when paths contain symbolic links. Examine whether the patch uses realpath() correctly and handles concurrency properly before treating the fix as resolved. For remediation: patch immediately, but also audit wp_options table for any stored traversal payloads that may have been injected before the patch was applied. A patched plugin does not automatically clear previously injected payloads—this is a common gap in remediation workflows for this vulnerability class.

Reviewed through automated stages and approved by a human before publication.