WordPress Plugin Backup and Restore version 1.0.3 contains an arbitrary file deletion flaw that allows authenticated attackers to delete any file within the WordPress installation directory by sending crafted POST requests to admin‑ajax.php. This vulnerability is a classic Directory Traversal (CWE‑22) issue; successful exploitation results in loss of site content, configuration files, or code that could enable further compromise. The degradation of data integrity could effectively bring the site offline if critical files are removed.

The vulnerability affects WordPress users running the Miniorange Backup and Restore plugin at version 1.0.3. No other versions or vendor products are listed as impacted in the CNA data.

The CVSS score of 8.7 indicates a high severity risk. EPSS information is not available, so the current likelihood of exploitation cannot be quantified, but the flaw is listed as “not in KEV” which suggests it has not yet been publicly exploited. The attack vector appears to be remote via a web request, but requires the attacker to be authenticated and have access to the WordPress admin panel with the plugin activated. Under these conditions, the flaw can be weaponised quickly by a determined adversary.