This vulnerability arises from an improper limitation of a pathname in the UPC/EAN/GTIN Code Generator plugin, allowing an attacker to craft a path that traverses the intended directory boundaries and delete arbitrary files on the server. The flaw is a classic path traversal issue (CWE-22) and can result in the deletion of crucial configuration or content files, thereby compromising the integrity of the website and potentially leading to a denial of service if critical files are removed.

WordPress installations that run the UPC/EAN/GTIN Code Generator plugin version 2.0.2 or earlier are affected. The plugin is developed by Dmitry V. (CEO of "UKR Solution"). No specific lower bound is given, so any version from the initial release up to and including 2.0.2 is considered vulnerable.

The CVSS score of 7.7 indicates a high severity, but the EPSS score of less than 1% suggests that exploitation is currently unlikely. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the attack vector is likely remote, occurring via web requests to the plugin’s interface, and would require the attacker to have some level of access to perform the malicious request. If exploited, an attacker could delete arbitrary files on the compromised server, potentially disrupting site operation or deleting sensitive data.