The Simple WP Events plugin contains an insufficient file path validation flaw in the wpe_delete_file AJAX action. Unauthenticated callers can request deletion of any file on the hosting server, enabling the attacker to delete critical configuration files such as wp-config.php. Removing such files can readily lead to remote code execution or cause the WordPress installation to become inoperable. This weakness is an example of CWE-73, which is known for uncontrolled file deletion vulnerabilities.

All WordPress installations running the Simple WP Events plugin version 1.8.17 or earlier are impacted. The vulnerability is specific to the wpminds:Simple WP Events plugin and affects sites that have not upgraded beyond the stated version.

The vulnerability has a CVSS score of 9.1, indicating a very high risk. The EPSS score of 1% shows that a non‑negligible probability of exploitation exists at this time. While the issue is not listed in CISA KEV, its lack of authentication requirements and the potential to delete critical files make it a serious threat that can be executed via a simple web request. Attackers can download the site’s public files, then issue a crafted AJAX request to delete any file on the server, leading to loss of data or remote code execution.