The Helloprint plugin contains a Path Traversal flaw (CWE‑22) that lets an attacker delete arbitrary files on the server. By manipulating a file path, the vulnerable code can operate outside the intended directory, causing loss of critical WordPress files, configuration data, or any file the web server can access, potentially leading to site downtime or collateral damage. Based on the description, it is inferred that such path manipulations are possible.

WordPress sites running the Helloprint plugin up to and including version 2.0.7. The vulnerability applies to all releases from the earliest available version through 2.0.7, as the plugin name is simply "helloprint."

The CVSS score of 7.7 indicates high severity, while an EPSS score of less than 1% suggests exploitation is currently rare, and the issue is not listed in the CISA KEV catalog. The typical attack path involves a crafted request that provides a path containing traversal sequences (e.g., "../") to the plugin, which then executes a file deletion operation. Based on the description, it is inferred that this path traversal is the method of exploitation. The flaw can be triggered by any user with access to the vulnerable endpoint, so authentication is not a strict prerequisite, making the vulnerability effectively publicly exploitable when the plugin is present. Based on the description, it is inferred that authentication may not be required for exploitation.