Administrator file deletion via stored path traversal

Path traversal in WordPlus Better Messages 2.15.19 and earlier allows remote authenticated users to delete arbitrary server files. The delete_sticker function accepts a stored sticker URL with a valid uploads-base prefix, converts its unnormalized path to a local filename, and deletes it; normalize_sticker applies esc_url_raw without removing ../ segments. Administrator access is required, and deletion of a security-critical file such as wp-config.php exposes the site to remote code execution.