The WP AUDIO GALLERY plugin suffers from a flaw where it fails to validate the file path supplied in the audio_upload parameter before calling unlink(). This weakness allows an authenticated user with subscriber-level permissions or higher to delete any file on the hosting server. The deletion of critical files such as wp-config.php could enable attackers to execute arbitrary code against the WordPress installation. The vulnerability is specific to the wpag_uploadaudio_callback() AJAX handler and results in loss of data integrity, potential availability issues, and, if critical files are removed, remote code execution. The principal weakness aligns with CWE‑73, which represents Improper Restriction of Operations within the Bounds of a File System Path, allowing unauthorized file deletion due to inadequate path validation.

The vulnerability affects all installations of the WP AUDIO GALLERY plugin by husainali52 with versions 2.0 or earlier. Upgrades beyond 2.0 are assumed to have addressed the missing path validation and should no longer expose the flaw.

The CVSS score of 8.1 indicates a high severity, while the EPSS score of less than 1% suggests that exploitation attempts may be rare. The issue is not listed in CISA’s KEV catalog, but the nature of the flaw and the potential for remote code execution mean that an attacker with subscriber-level access— a relatively low privilege threshold— can pose a significant threat. The attack vector is a web‑based AJAX call that requires a valid authenticated session; an attacker would need to authenticate and then supply a crafted audio_upload parameter to target arbitrary file paths.