The Database Toolset plugin, used in WordPress, allows unauthenticated users to delete arbitrary files on the server because the plugin lacks file‑path validation, a CWE‑22 weakness. The missing checks enable an attacker to target critical WordPress files such as wp‑config.php. Removing such files can cause loss of configuration, site availability, and can lead to remote code execution if the attacker subsequently replaces the deleted file with malicious code.

Neoslab Database Toolset plugin for WordPress. All installations of the plugin version 1.8.4 or earlier are affected. The vulnerability exists in any active installation where the administrative functionality is not protected by additional access controls.

The CVSS score of 9.1 indicates high severity, and the EPSS score of <1% suggests that exploitation is unlikely in real-world traffic. The vulnerability is not listed in CISA KEV. Based on the description, it is inferred that an unauthenticated HTTP request to the plugin’s admin endpoint could trigger deletion, but the exact attack vector is not explicitly stated; any publicly accessible WordPress site running the affected plugin is at risk.