The E‑exact | Hosted Payment | WordPress plugin version 2.0 contains a flaw that allows an unauthenticated attacker to delete arbitrary files on the server. The vulnerability stems from insufficient validation of file paths used by the plugin when removing files. Successful exploitation can result in loss of critical data, service disruption, or compromise of the web application. The weakness is an example of improper input validation (CWE‑20).

All WordPress installations that use the E‑exact | Hosted Payment | plugin with a version of 2.0 or earlier are affected. The plugin publisher is listed under Unknown:E‑exact | Hosted Payment |; no further vendor detail is available.

The CVSS score of 9.1 indicates a high‑severity risk. The EPSS score is below 1%, suggesting that while the risk is severe, the likelihood of active exploitation is currently low. The vulnerability is not listed in the CISA KEV catalog. The attack vector is unauthenticated, implying that a remote attacker can trigger the deletion without needing to authenticate. The primary conditions for exploitation are that the compromised server hosts the vulnerable plugin and that the attacker can interact with the plugin’s file deletion functionality, such as via crafted HTTP requests. Without authentication, the exploitation path is straightforward, making this a serious concern for sites that rely on the plugin for payment processing.