This vulnerability is a path traversal flaw in the WordPress Pie Register Premium plugin that permits an attacker to construct file paths for the delete operation. The flaw results in the removal of one or more files on the web server, which can include potentially critical configuration or content files. The impact is limited to deletion rather than arbitrary file modification or disclosure, but the loss of files can still lead to data loss, downtime, or compromise of site availability.

All installations of the WordPress Pie Register Premium plugin up to and including version 3.8.3.2 are affected. The plugin is distributed by NotFound and is commonly used for user registration and management within WordPress sites.

The CVSS score of 6.3 indicates moderate severity, while the EPSS score of less than 1% suggests a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, and there are no confirmed public exploits at the time of this analysis. The attack vector is inferred to be remote, accessed through the plugin’s web interface, as the flaw enables path manipulation in a request that triggers file deletion.