WordPress Scape theme < 1.5.16 - Arbitrary File Deletion vulnerability

The Arbitrary File Access vulnerability allows an attacker to bypass intended access controls and retrieve files from the server's file system. Successful exploitation could lead to the disclosure of sensitive information such as configuration files, database credentials, or even source code. Depending on the server's configuration and the files accessible, this could lead to further compromise, including code execution or data breaches. While no specific precedent is immediately apparent, path traversal vulnerabilities are frequently exploited to gain unauthorized access to critical system resources.

WordPress websites utilizing the Whitebox-Studio Scape plugin, particularly those running versions prior to 1.5.16, are at risk. Shared hosting environments where users have limited control over plugin configurations are also particularly vulnerable.

• wordpress / composer / npm:

grep -r "../" /var/www/html/wp-content/plugins/scape/*

• generic web:

curl -I 'http://your-wordpress-site.com/wp-content/plugins/scape/../../../../etc/passwd' # Check for unauthorized file access

1. 2026-03-25Disclosure

   disclosure

1. Reserviert2026-03-10
2. Veröffentlicht2026-03-25
3. Geändert2026-04-29
4. EPSS aktualisiert2026-04-02

The primary mitigation for CVE-2026-31913 is to upgrade Whitebox-Studio Scape to version 1.5.16 or later. If immediate upgrading is not possible due to compatibility issues or downtime constraints, consider implementing temporary workarounds such as restricting file access permissions on the server and implementing a Web Application Firewall (WAF) with rules to block suspicious path traversal attempts. Monitor access logs for unusual file requests and implement stricter input validation to prevent malicious path manipulation. After upgrading, confirm the vulnerability is resolved by attempting a path traversal request and verifying that access is denied.