Vulnerabilities and security researches forsucuri-scanner sucuri-scanner

Jun 06, 2024

CVE, Research URL: CVE-2022-29489
Home page URL: Security reports for Sucuri Security – Auditing, Malware Scanner and Security Hardening
Application: Sucuri Security – Auditing, Malware Scanner and Security Hardening
Date: Sep 17, 2022
Research Description: Cross-Site Request Forgery (CSRF) vulnerability in Sucuri Security plugin <= 1.8.33 at WordPress leading to Event log entry creation.
Affected versions: max 1.8.34.
Status: vulnerable

Feb 24, 2025

PSC, Research URL: PSC-2025-64557
Home page URL: Security reports for Sucuri Security – Auditing, Malware Scanner and Security Hardening
Application: Sucuri Security – Auditing, Malware Scanner and Security Hardening
Date: Aug 05, 2025
Research Description: Sucuri Security is a powerful security plugin designed to protect WordPress websites from various cyber threats. Developed by Sucuri Inc., a globally recognized leader in website security, this plugin provides comprehensive protection through real-time monitoring, malware scanning, and security hardening. Now owned by GoDaddy, Sucuri Security continues to offer robust security features for WordPress users, ensuring their websites remain protected against unauthorized access, malware infections, and other vulnerabilities. The plugin has successfully passed a rigorous security evaluation and has been awarded the Plugin Security Certification (PSC) from CleanTalk, guaranteeing compliance with the highest security standards.
Affected versions: Min 2.8, max 2.8.
Status: SAFE & CERTIFIED

Aug 11, 2026

CVE, Research URL: CVE-2026-73033
Home page URL: Security reports for Sucuri Security – Auditing, Malware Scanner and Security Hardening
Application: Sucuri Security – Auditing, Malware Scanner and Security Hardening
Date: Aug 11, 2026
Research Description: Sucuri Security WordPress plugin through version 2.7.3 contains a path traversal vulnerability in the pageIntegritySubmission() method in src/integrity.lib.php that allows authenticated administrators to delete arbitrary files by supplying directory traversal sequences in the sucuriscan_integrity parameter. Attackers can manipulate the unsanitized file path concatenated with ABSPATH to traverse outside the WordPress installation directory and invoke unlink() on sensitive files such as wp-config.php and .htaccess, causing site outage or enabling malicious reinstallation.
Affected versions: max 2.7.3.
Status: vulnerable