The vulnerability lies in inadequate file path validation in the deleteImage() routine, allowing an attacker who is authenticated with Subscriber-level permissions or higher to instruct the plugin to delete any file on the server. This flaw permits direct file system manipulation, which, when used to delete critical configuration files such as wp-config.php, can lead to remote code execution or other severe compromises. The weakness is a classic path traversal problem identified by CWE‑23.

WordPress sites running the WP Ultimate CSV Importer plugin from smackcoders. All deployments using version 7.19 or earlier, as well as version 7.20 where the flaw was reintroduced, are affected until the fix releases in 7.20.1. Upgrades to 7.20.1 or later eliminate the issue.

The CVSS score of 8.1 reflects high severity, and the EPSS score of 5% indicates a moderate probability of exploitation. Because the attack requires only subscriber‑level credentials—common in many sites—the risk is significant for sites with widespread Subscriber roles. The flaw is not listed in the CISA KEV catalog, but the potential for remote code execution makes it a priority to remediate before exploitation occurs. The attack vector is likely web‑based, with an authenticated user submitting a crafted request to initiate the deleteImage() action. No special conditions beyond Subscriber privileges are indicated by the data.