The vulnerability allows an attacker to exploit a relative path traversal flaw in the Delete Comments By Status plugin, enabling them to read arbitrary files on the WordPress server. This can lead to a confidentiality breach if sensitive files such as configuration or credential files are accessed. The weakness is classic path traversal (CWE-23) and poses a high potential impact if exploited.

Shah Alom Delete Comments By Status is a WordPress plugin that is vulnerable in all versions from the initial release up to and including 2.1.1. Sites running any of these versions are affected if the plugin remains activated.

The CVSS score of 7.5 indicates high severity, while the EPSS score of less than 1% indicates a low probability of exploitation in the near term. The vulnerability is not listed in the CISA KEV catalog. Exploitation can typically be achieved by sending a crafted request to the plugin’s file inclusion endpoint that contains a relative path designed to traverse directories and access sensitive files. Since the flaw is only LFI, further attack steps would depend on the attacker’s ability to read or exploit server files, potentially escalating privileges if critical files are read.