The Uni CPO (Premium) plugin for WooCommerce contains a vulnerability in the uni_cpo_remove_file function where a required capability check is missing, allowing anyone with knowledge of an attachment or Dropbox file path to remove those files. This flaw results in unauthorized data deletion, which can affect product images, documentation, or other sensitive content stored by the site. The weakness is classified as Missing Authorization (CWE-862).

WordPress sites that use the Product Options and Price Calculation Formulas for WooCommerce – Uni CPO (Premium) plugin version 4.9.60 or earlier are impacted. Sites running the plugin at these versions or any earlier release are susceptible to the issue. No additional versions are known to be affected beyond the stated cutoff.

The CVSS base score of 5.8 indicates medium severity, while the EPSS score of less than 1% signifies a low probability of exploitation at this time. The vulnerability has not appeared in the CISA KEV catalog, but it remains publicly documented and could be leveraged by attackers who discover or guess the file path. Because the flaw permits file deletion without authentication, the risk surface is moderate, yet the overall exploitation likelihood remains low due to the requirement of path knowledge and lack of widespread exploitation reports.