The vulnerability is a path traversal flaw that permits any registered user to delete arbitrary files by submitting unescaped filenames through the delete_export_file AJAX action. By crafting POST requests that include directory traversal sequences, an attacker can target sensitive files such as wp-config.php, resulting in loss of essential configuration data and a potential compromise of site integrity and confidentiality. This issue is classified as CWE-22.

The problem affects the WooCommerce CSV-Importer plugin for WooCommerce, specifically version 3.3.6. No version information is provided for later releases; affected versions are those equal to or older than 3.3.6.

With a CVSS score of 8.7, the vulnerability is considered high severity; its EPSS score is not available and it is not listed in the CISA KEV catalog. The attack vector is remote but requires only a legitimate registered user account, making exploitation straightforward for anyone who can access the WordPress site. Successful exploitation results in deletion of critical files, which can lead to site downtime, data loss, and increased administrative effort to recover configuration files.