This vulnerability in the WP Pipes plugin permits an attacker to delete files outside the intended directory. By omitting proper pathname checks, a crafted request can target any file on the server, resulting in unauthorized file deletion and potential loss of critical data. The weakness is a classic path traversal flaw identified as CWE‑22.

The problem affects the WordPress plugin WP Pipes developed by ThimPress, versions up through 1.4.2. All installations of the plugin in the WordPress ecosystem that have not been updated to a newer release remain susceptible.

The CVSS score of 8.6 indicates high severity, while the EPSS score of less than 1 % suggests that the likelihood of an attack is currently low but could rise if the flaw is actively exploited. The vulnerability is not yet listed in the CISA KEV catalog. Exploitation requires an attacker to send a specially crafted request to the plugin’s endpoint, normally accessible via the web interface, pointing the path traversal to a target file. If successful, the attacker can delete arbitrary files from the server, potentially compromising the website’s integrity and availability.