The TicketBAI Facturas para WooCommerce plugin accepts a 'delpdf' action that allows files to be deleted without proper path validation. An attacker can supply any file path, leading to arbitrary file removal on the server. If critical files such as wp-config.php are deleted, the attacker can pivot to remote code execution or other destructive actions.

The vulnerability exists in the TicketBAI Facturas para WooCommerce WordPress plugin by facturaone. All releases up to version 3.18 are affected. Users running these versions are at risk unless they upgrade.

The CVSS base score of 9.8 indicates critical severity. The EPSS score of 4% indicates moderate likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires no authentication; a simple HTTP request targeting the plugin's 'delpdf' endpoint can trigger the flaw. Because the attacker can specify arbitrary file paths, deletion of key configuration or core files can enable remote code execution, making this a high priority risk.