The Export and Import Users and Customers plugin for WordPress allows an authenticated attacker with Administrator privileges to delete arbitrary log files on the server due to insufficient file path validation in the admin_log_page() function. If exploited, the attacker can remove or tamper with log files, creating a denial‑of‑service scenario or erasing audit trail evidence. The weakness is classified as CWE‑73.

The vulnerability affects the Webtoffee Export and Import Users and Customers WordPress plugin. All versions up to and including 2.6.2 are impacted. Users of this plugin on any WordPress installation should confirm their plugin version.

The CVSS score of 2.7 indicates low to moderate severity, and the EPSS score of less than 1% suggests exploitation is unlikely but not impossible. The vulnerability is not listed in CISA KEV. Exploitation requires the attacker to be a legitimate WordPress Administrator or higher and to supply a crafted path to the admin_log_page function; the plugin does not perform proper path sanitization, enabling the deletion of any file the web server can access.