The Fastw3b FW Gallery plugin suffers a Path Traversal flaw (CWE-22) that lets an attacker delete any file located on the web server. The vulnerability can be triggered by an HTTP request that bypasses the plugin’s directory restrictions, allowing removal of configuration files, database files, or other critical content. This leads to data loss, service disruption, and can serve as a foothold for further compromise if essential files are removed or corrupted.

All installations of the Fastw3b FW Gallery WordPress plugin with a version number of 8.0.0 or earlier, including any pre‑release builds. Any WordPress site that has this plugin active is potentially exposed.

The CVSS score of 8.6 marks it as high severity, while the EPSS score of less than 1 percent indicates low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Exploitation likely involves sending a crafted HTTP request to the plugin’s file‑deletion endpoint; whether authenticated access is required is not specified in the CVE data, and this is inferred from typical plugin behavior. If exploited, an attacker could delete arbitrary files, break the site, and facilitate additional attacks.