The Database Toolset plugin allows unauthenticated users to delete arbitrary files on the server because the file path validation is not performed when a request is made to a function present in all releases up to 1.8.4. An attacker can target critical WordPress files such as wp-config.php; deleting this file can drop the site into a state that permits arbitrary code execution or other destructive actions. The resulting loss of configuration, content, and potentially the ability to install malware is severe.

Neoslab Database Toolset plugin for WordPress, any version installed on the site with a version number of 1.8.4 or earlier is affected. The vulnerability exists for all installations that have the plugin active and do not employ additional access controls on its administrative functionality.

The CVSS score of 9.1 indicates a high severity, and the EPSS of 4% suggests the exploit is moderately likely to be seen in real-world traffic. The vulnerability is not listed in CISA KEV, meaning no known large-scale exploitation campaign has been formally documented yet. Attackers can trigger the deletion via an unauthenticated HTTP request to the plugin’s admin endpoint, so any publicly accessible WordPress site running the affected plugin is at risk.