# Multiple File Manipulation bugs in WP Super Cache

WP Super Cache's `..` filter is bypassed with null bytes (`.%00.../`), letting attackers path-traverse to delete arbitrary files via `deletepage`.

- Payout: hidden
- Severity: high
- Program: Automattic
- Found by: paulos__
- Disclosed: 2018-10-29
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/240886
- Library page: https://bugbountylibrary.com/r/h1%3A240886
- Tags: area:web domain:web impact:integrity kind:bounty platform:hackerone sev:high tech:php tech:wordpress technique:source-review vuln:path-traversal

**Target:** WordPress plugin PHP files (wp-cache.php, wp-cache-phase1.php, advanced-cache.php)
**Root cause:** The plugin strips `..` via str_replace to block traversal, but a null byte inserted between dots (`.%00.../`) survives filtering and is interpreted by the filesystem as `../`, restoring traversal.
**Steps:**
1. Send `deletepage=.%00.../.%00.../path.file` to the deletepage handler
2. Filter removes spaces/special chars but leaves `.%00.../` intact
3. `str_replace('..','',...)` does not match because dots are separated by null byte
4. Resulting path resolves to `../../path.file`; `realpath`/`unlink` deletes the target file
**How found:** While poking around the code, noticed the `..` filter and hypothesized a null-byte-in-the-middle bypass, then tested against the filter logic.
**Exploitation:** Attacker submits crafted `deletepage` POST value; plugin builds path with traversal, realpath resolves it, and unlink removes the target file (and `.gz` variant), enabling arbitrary file deletion on the server.
**Insight:** When a filter strips a multi-char sequence like `..`, try inserting null bytes or other separators between the characters to defeat the match while the OS still interprets the path as traversal.