The vulnerability, identified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), is a Path Traversal flaw that allows an attacker to delete arbitrary files on the file system by manipulating input paths. Successful exploitation can result in loss of content, configuration files, or other critical data, compromising the integrity and availability of the affected WordPress site. No mention is made of privilege escalation beyond the web application context in the description.

RobMarsh Image Shadow plugin for WordPress is affected when installed in version 1.1.0 or earlier. All installations of that plugin that have not been updated to a newer release are vulnerable.

The CVSS score of 7.7 indicates high severity, while the EPSS score of less than 1% suggests that active exploitation is currently unlikely but the risk is not negligible. The vulnerability is not listed in the CISA KEV catalog. The description indicates a Path Traversal weakness; the likely attack vector is through the plugin’s file handling endpoint that accepts user-supplied paths, which an attacker could manipulate to target any writable file on the server. Successful exploitation requires the WordPress process to have write permissions to the target file, a condition typically satisfied for common site files.