This vulnerability is a Path Traversal flaw that allows an attacker to delete any file accessible to the web server. By exploiting the Improper Limitation of a Pathname to a Restricted Directory weakness, the attacker can remove critical WordPress files or other system files, potentially leading to data loss and disruption of site availability. The CVSS score of 7.5 indicates a high severity risk.

The issue affects the WP Cloud plugin developed by Marco Milesi, for all releases up to and including version 1.4.3. Any WordPress installation that has this plugin installed at a vulnerable version is impacted.

The vulnerability has an EPSS score of less than 1%, suggesting a low probability of exploitation, and it is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector is remote, accessible via the plugin’s web interface, but exploitation requires that the attacker can send requests that reach the vulnerable file deletion endpoint. Once exploited, an attacker can delete arbitrary files, creating significant integrity and availability concerns for the affected WordPress site.