The vulnerability is a path traversal flaw that allows an attacker to delete arbitrary files on the server. The weakness, identified as CWE-22, arises from insufficient validation of a file path supplied to a deletion routine in the FW Food Menu plugin. If successfully exploited, an attacker could remove critical configuration files, application data, or other server files, leading to loss of availability and potential exposure of confidential data.

Fastw3b LLC FW Food Menu plugin version 6.0.0 and any earlier versions installed on WordPress sites are potentially vulnerable. Any WordPress instance with the plugin at or below 6.0.0 is vulnerable. The description does not list additional affected components, so the scope is limited to the plugin itself.

The vulnerability scores 8.6 on CVSS, indicating high severity, but the EPSS score is below 1 %, suggesting current independent exploitation is low. The vulnerability is not listed in the CISA KEV catalog. Attackers would likely trigger the deletion via a crafted request to the plugin’s file deletion endpoint; the vector is web-facing and may require authenticated or privileged access, although the description does not state explicit prerequisites, so any user able to invoke the deletion action may be able to exploit it.