The XLSXviewer plugin for WordPress suffers from a Path Traversal flaw (CWE-22) that permits an attacker to delete arbitrary files on the server. By crafting a malicious request that manipulates the file path parameter, the plugin fails to restrict the pathname to a safe directory, leading to deletion of files within the WordPress file system. This can result in loss of website data, configuration files, or other critical assets, effectively compromising the integrity and availability of the site.

The vulnerability affects the XLSXviewer plugin by pitinca, versions up to and including 2.1.1. Any WordPress installation that has this plugin installed and updated to 2.1.1 or earlier is susceptible. The issue is present from the initial release of the plugin through the stated maximum version.

The CVSS score of 7.5 indicates a high risk to confidentiality and integrity, while an EPSS score of less than 1% suggests a low likelihood of exploitation at present. The vulnerability is not listed in CISA KEV, implying no publicly documented active exploitation. The likely attack vector, inferred from the plugin's functionality, is through an exposed endpoint that accepts file path input, potentially reachable by unauthenticated users or users with plugin access. Given the severity and potential impact, administrators should treat this as a high-priority concern.