The Simple WP Events plugin contains a Path Traversal weakness that enables an attacker to delete any file on the WordPress server. Based on the description, it is inferred that an attacker can supply malicious input that resolves to an absolute filesystem path, allowing a remote user to remove critical configuration files or content, resulting in site compromise or data loss. The flaw is identified as CWE‑22 and can lead to destructive denial of service.

This issue affects the WordPress Simple WP Events plugin from WPMinds, specifically all releases up to and including version 1.8.17. Any WordPress installation that has this plugin installed and exposed to the web is impacted. The vendor product is identified as WPMinds:Simple WP Events.

The vulnerability carries a CVSS score of 7.5, indicating a high severity. The EPSS score of less than 1% suggests that automated exploitation is currently rare, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the flaw can be triggered via a crafted HTTP request, allowing remote exploitation. Based on the description, it is inferred that an attacker with network access to the WordPress site could use the path traversal to delete arbitrary files and potentially disrupt service or cause further compromise.