Arbitrary file deletion in wp-core - guides towards RCE and information disclosure

Vulnerable place 1: `wp-admin/post.php` `$newmeta['thumb']` is placed into DB not sanitized directly from user input.

case 'editattachment':
    check_admin_referer('update-post_' . $post_id);
    // Don't let these be changed
    unset($_POST['guid']);
    $_POST['post_type'] = 'attachment';
    // Update the thumbnail filename
    $newmeta = wp_get_attachment_metadata( $post_id, true );
    $newmeta['thumb'] = …