vulnerable to Directory Traversal – critical threat

I have looked into the code (and it looked back, jk)

I’d consider this somewhere between a non-issue and “well, it’s not nice, but it still is a non-issue”.

I’d assume, the problem they mention is this block in the mentioned method.

https://github.com/afranken/All-In-One-Favicon/blob/5a7edd3af3c2bcc8c3272dc3b0d9c9e3d18031ac/includes/aio-favicon-backend.php#L230

It has files deleted that come from $_POST and have a certain format. The method that actually deletes is here and it checkes if the file is within the upload folder:

https://github.com/afranken/All-In-One-Favicon/blob/5a7edd3af3c2bcc8c3272dc3b0d9c9e3d18031ac/includes/aio-favicon-backend.php#L316

Well, you could only exploit this issue when you are an administrator and logged in. Contrary to report you linked, you could NOT delete “any” file in your WP installation. You can only do so within your upload folder. And well, you can do this as well using WP’s media library when you’re admin.

So well. I guess this could be improved. But at the moment, I don’t see show stopper here.