A flaw in the Invelity Product Feeds WordPress plugin allows authenticated administrators to delete arbitrary files on the server. The weakness is a Cross‑Site Request Forgery (CWE‑352) that arises from missing validation in the createManageFeedPage function, enabling path traversal sequences to reach any file path. When an administrator unknowingly submits a crafted request—such as clicking a malicious link—the plugin deletes the target file, compromising site integrity and potentially causing defacement or downtime.

All installations of the Invelity Product Feeds plugin for WordPress up to and including version 1.2.6 are affected. The vulnerability applies to users with administrator privileges, the minimum authority required to trigger the deletion action.

The issue carries a high CVSS score of 8.1, reflecting significant potential impact. No EPSS data is available and it is not listed in the CISA KEV catalog, suggesting limited public exploitation at present. However, exploitation requires only that an administrator process a malicious request, making the attack path straightforward for an authenticated attacker. The primary risk stems from the possibility of an admin unintentionally triggering file deletions, leading to data loss, service interruption, and costly recovery effort.