An attacker can delete any file on the WordPress site by exploiting a path traversal flaw in the CM Download Manager plugin. The weakness allows the malicious user to craft a URL that bypasses the intentional directory bounds, resulting in the removal of arbitrary files. This type of bypass violates the principle of restricted file access and can lead to loss of critical content, configuration files, or code that could further compromise the system.

WordPress sites that have the CreativeMindsSolutions CM Download Manager plugin installed at version 2.9.6 or earlier. The vulnerability covers all releases described as "from n/a through <= 2.9.6".

The CVSS score of 8.6 indicates high severity, yet the EPSS score is below 1%, suggesting a very low probability of exploitation currently. The vulnerability is not listed in the CISA KEV catalog, so there is no documented large‑scale exploitation as of the last update. The attack vector is inferred to be remote via HTTP requests, as text analysis shows the flaw is triggered by URL manipulation within the web application. All conditions for exploitation revolve around having network access to the WordPress instance and administrative or file‑write permissions on the server.