The vulnerability in the Database Toolset plugin allows an attacker to traverse directory boundaries and delete files outside the expected upload area. This path traversal flaw can result in the removal of critical configuration files, website assets, or other data causing significant damage to confidentiality and availability. The weakness is identified as CWE-22 and is rated with a CVSS score of 8.6.

The affected product is the WordPress Database Toolset plugin developed by neoslab. Any WordPress installation running Database Toolset version 1.8.4 or earlier is vulnerable. The version range is described as "from n/a through <= 1.8.4" indicating that all releases up to this point are impacted.

The EPSS score of less than 1 % suggests that exploitation attempts are expected to be infrequent, yet the high CVSS indicates that the impact of successful exploitation is severe. The vulnerability is not registered in the CISA KEV catalog. Exploitation would most likely occur via a remote HTTP request to the plugin’s interface or REST endpoint, allowing an attacker to supply a crafted file path; therefore, authenticated or unauthenticated access to the vulnerable endpoint would enable deletion of arbitrary files on the host. Defense in depth demands that sites correct the flaw promptly.