This vulnerability allows an attacker to delete arbitrary files on the server because the Welcart e‑Commerce plugin for WordPress does not properly constrain user supplied paths, resulting in a path traversal flaw identified as CWE‑22. By exploiting this weakness the attacker’s deletion could compromise application data, configuration files, or assets, leading to loss of confidentiality and integrity of the site’s file system.

Welcart e‑Commerce plugin for WordPress, all versions up to and including 2.11.13 supplied by info@welcart, are affected. Any WordPress site installed with these versions inherits the path traversal flaw.

The CVSS score of 6.8 indicates moderate severity, while an EPSS score of less than 1% suggests a low current probability of exploitation. The vulnerability is not listed in CISA's KEV catalog, implying no widespread exploitation has been reported. Based on the description, it is inferred that an attacker could trigger the file deletion through a crafted request that walks out of the intended directory boundaries.