The plugin’s upload_function() lacks proper file path validation, allowing an authenticated user with Subscriber-level access or higher to specify any file path and delete files on the server. The vulnerability is a classic CWE-73 path traversal flaw; deleting critical files such as wp-config.php can lead to full site compromise. The impact is loss of data integrity and availability, and it can enable remote code execution if the deleted file is essential for secure operation.

The vulnerability affects version 7.27 and earlier of the WP Ultimate CSV Importer plugin by smackcoders, an import tool for WordPress that handles CSV, XML, and Excel files.

The CVSS score of 8.1 indicates a high severity, while the EPSS score of less than 1% suggests a low current exploitation likelihood. The issue is not listed in CISA’s KEV catalog. The likely attack vector requires authentication; a subscriber or higher role can trigger the delete function after logging into the WordPress dashboard. Successful exploitation requires that the targeted server files be writable and that the attacker knows a valid file path to delete.