The Avatar plugin contains an insufficient file path validation that lets an authenticated user delete any file on the server. With Subscriber-level access or higher, an attacker can remove critical files such as wp-config.php, which can quickly lead to remote code execution.

All installations of the Avatar plugin by wonderboymusic up to version 0.1.4 are affected. Any WordPress site running these plugin versions is vulnerable; the issue originates from the plugin's file deletion function.

The CVSS score of 8.1 reflects a high severity remote exploitation risk, while an EPSS score of 5% indicates a moderate likelihood of exploitation in the wild. The vulnerability is not listed in CISA KEV. Attackers need to be authenticated as at least a Subscriber but can perform file deletion from a remote interface, making the attack vector network-based. Once a critical file is removed, code execution could be achieved.