Technical impact
The Data Tables Generator by Supsystic plugin contains insufficient file path validation in its cleanCache() function. This flaw, classified as CWE-22, allows an attacker with authenticated Administrator‑level access to craft requests that delete arbitrary files on the WordPress server. If critical files such as wp-config.php are removed, the attacker can then achieve remote code execution through configuration compromise.
Affected Systems
WordPress installations using the Data Tables Generator by Supsystic plugin, any version up to and including 1.10.45, regardless of minor sub‑versions. The vulnerability applies to all standard installations of the plugin without customization of the cleanCache() routine.
Risk and Exploitability
The CVSS score of 6.5 indicates moderate severity, and an EPSS score of <1% indicates an extremely low likelihood of exploitation. The flaw is not listed in CISA KEV, suggesting no currently known widespread exploitation. The attack vector is authenticated, requiring Administrator or higher privilege. An attacker who gains such access can delete arbitrary files; if a core or configuration file is removed, remote code execution or a complete site takeover becomes possible.
