A directory traversal flaw in the admin_log_page() function of the Product Import Export for WooCommerce plugin allows an attacker who holds Administrator privileges in WordPress to delete arbitrary log files on the server. The vulnerability does not grant code execution or data exfiltration, but it removes audit trail information, potentially reducing the ability to investigate incidents or debug the system. Because the affected function operates on paths supplied by the user, the attacker can target any file that the web server process can write to, which may include security or access logs.

The flaw affects the webtoffee Product Import Export for WooCommerce – Import Export Product CSV Suite plugin for WordPress, any version 2.5.0 or earlier. The plugin is installed on WordPress sites and is identified as webtoffee:product_import_export_for_woocommerce in the CPE registry.

With a CVSS score of 2.7 the vulnerability is considered a low severity issue, and its EPSS score is below 1%, indicating a very low likelihood of exploitation. The exploit requires an authenticated user with Administrator level or higher privileges; thus, a local attacker who can log into the WordPress admin interface is sufficient to trigger the deletion. The vulnerability is not listed in the CISA KEV catalog, so no widely known exploits are published at the time of this analysis.