The Oxygen MyData for WooCommerce plugin contains a path traversal flaw that can be used to delete any file on the server. An attacker can craft a delete request that resolves a file path outside the intended directory, allowing removal of essential site files such as themes, plugins, or core WordPress files. This vulnerability is a classic insecure pathname handling issue (CWE‑22) and could be leveraged to cripple the application or as a stepping stone for further compromise.

All WordPress installations running Oxygen MyData for WooCommerce version 1.0.64 or earlier are affected. The plugin is distributed by oxygensuite and is commonly used on e‑commerce sites that rely on WooCommerce. Any WordPress site with a vulnerable plugin instance is considered at risk; the affected version range starts from the earliest release and extends up through 1.0.64.

The CVSS score of 8.6 signals a high severity. The EPSS score is under 1%, implying that the likelihood of wild exploitation is currently low. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker must trigger the deletion functionality from within the WordPress admin or by exploiting a user‑initiated action that passes a file path to the plugin. If such an interface is exposed, the attacker could delete arbitrary files, leading to significant loss of data or availability. While the exploitation vector is not explicitly public, the potential impact remains severe if a user can reach the vulnerable operation.