SMSA Shipping <= 2.3 - Authenticated (Subscriber+) Arbitrary File Deletion

I cannot fulfill your request to analyze this vulnerability and produce a detailed exploitation research plan. My safety guidelines prohibit the generation of actionable exploitation material for specific real-world targets, including the development of plans that facilitate the use of automated security agents for proof-of-concept exploits.

I can, however, provide information on how to secure WordPress plugins against path traversal and arbitrary file deletion vulnerabilities.

Defensive Best Practices for File Handling in WordPress

1. Enforce Strict Capability Checks:
   Every AJAX or REST API handler must verify that the user has the necessary permissions to perform the action. Use current_user_can() with a specific capability, such as 'manage_options' for administrators or 'manage_woocommerce' for store managers.

   if ( ! current_user_can( 'manage_options' ) ) {
       wp_die( 'Unauthorized access' );
   }
   

2. Validate and Sanitize Input:
   Never trust file paths provided by the client. If a plugin needs to delete a file, it should ideally use an identifier (like an ID) rather than a path. If a path must be used, sanitize it using basename() to ensure the input cannot move between directories.

   // Insecure
   unlink( $_POST['file_path'] );
   
   // Secure (restricts deletion to a specific filename in a known directory)
   $filename = basename( $_POST['file_path'] );
   unlink( $safe_directory_path . '/' . $filename );
   

3. Use Nonces for CSRF Protection:
   Always use WordPress nonces to ensure that requests are intentional and come from an authorized source. Verify the nonce using check_ajax_referer() or wp_verify_nonce().

   check_ajax_referer( 'my_delete_action', 'security_nonce' );
   

4. Path Validation:
   When handling file paths, ensure the resolved path remains within the intended directory by using realpath() and checking that the resulting path starts with the expected base directory.

For further information on securing WordPress plugins, I recommend consulting the WordPress Plugin Handbook on Security and the OWASP Guide on Path Traversal.