The Background Control plugin for WordPress accepts a CSRF‑enabled request that manipulates a file path parameter, allowing an attacker to delete arbitrary files on the web host. The flaw is a classic Cross‑Site Request Forgery (CWE‑352) combined with insufficient path validation. An attacker could persuade an authenticated administrator or user to visit a crafted URL, resulting in removal of critical files, potential loss of site content, or even complete site takeover if core files are deleted.

Vendors: Swedish Boy; Product: Background Control plugin for WordPress. All versions from the initial release up through 1.0.5 are affected. The vulnerability was present in every prior release, thus any WordPress site that has not upgraded beyond 1.0.5 is at risk.

The CVSS score of 8.6 indicates high severity, but the EPSS score of less than 1% means the attack likelihood is currently very low. It is not listed in the CISA KEV catalog, suggesting no widely reported exploitation. The likely attack vector is a remote web request; an adversary only needs to lure a privileged user to click a malicious link. Once the file deletion endpoint is hit, no further exploitation is required, making the impact straightforward but potentially devastating if core files are removed.