Improper limitation of a pathname to a restricted directory allows an attacker to delete arbitrary files from a WordPress site. The flaw arises in how the Drag and Drop File Upload for Elementor Forms plugin handles file deletion requests, permitting path traversal that bypasses intended directory restrictions. This weakness, identified as CWE-22, can lead to removal of configuration files, media assets or other critical content, effectively compromising the site’s integrity and availability.

The vulnerability affects the add-ons.org WordPress plugin “Drag and Drop File Upload for Elementor Forms”, specifically versions up to and including 1.4.3. No explicit patch version is listed, but any release beyond 1.4.3 is presumed to contain the fix. Site administrators should determine whether the affected plugin is installed and identify the version in use.

The CVSS score of 8.6 categorizes this flaw as high severity, and the EPSS score of 1% indicates a low but non‑zero probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Attacks likely occur through the plugin’s web interface, where an attacker can manipulate deletion requests to target arbitrary paths. Successful exploitation would result in file deletion, thereby compromising site availability and integrity.