The flaw is an improper limitation of a pathname to a restricted directory, enabling path traversal that can be abused to delete arbitrary files on the affected server. This allows a malicious actor to remove application data, configuration files, or even core WordPress files, thereby disrupting service and potentially paving the way for further compromise.

JoomSky’s JS Help Desk plugin for WordPress, across all versions up through 2.9.2.

The CVSS score of 8.6 indicates high severity, while the EPSS score of less than 1% reflects a low current exploitation probability, and the vulnerability is not listed in CISA KEV. The likely attack vector is via crafted HTTP requests to the plugin’s administrative interface, as inferred from the description of a path traversal flaw. Successful exploitation would grant deletion rights to arbitrary files within the web root, endangering confidentiality, integrity, and availability of the site.