This vulnerability is a cross‑site request forgery that allows an attacker to cause the victim’s browser to send a request to delete files on the server using path traversal. The attack can wipe configuration files, database backups, or other critical data, leading to loss of availability and potential data loss. The flaw is classified as CWE‑352, a weakness that exploits improper validation of user‑controlled requests.

The PoEditor WordPress plugin, versions from the original release up to and including 0.9.10, is affected. Users running any older revision of the plugin on a WordPress installation are vulnerable.

The CVSS score of 7.4 indicates a high impact if exploited. The EPSS score of less than 1% suggests that the likelihood of exploitation in the wild is low at present. The vulnerability is not listed in CISA’s KEV catalog. Attacks would typically require a victim who is logged into the WordPress site to click a crafted link or load a malicious page that tricks the browser into issuing the deletion request. No network‑level access is required, so the risk is largely contingent on user interaction.