WordPress 4.9.7 update fixes a vulnerability that allowed a registered user with certain privileges to delete an arbitrary file via a path substitution in the media manager.
We update promptly.
https://wordpress.org/news/2018/07/wordpress-4-9-7-security-and-maintenance-release/