The WooCommerce Purchase Orders plugin fails to validate file paths in its delete_file() routine, enabling any authenticated user with Subscriber level or higher to remove any file on the hosting system. Deleting critical configuration files such as wp-config.php could immediately lead to full compromise of the WordPress installation.

The vulnerability affects the WooCommerce Purchase Orders plugin for WordPress distributed by bbioon. Sites that have installed any version up to and including 1.0.2 are vulnerable. The plugin is used within WooCommerce stores and is accessible to users with Subscriber role permissions or higher.

The CVSS score of 8.1 indicates high severity, and the EPSS value of 1% suggests that exploitation, while not common, is conceivable in the wild. The vulnerability is not listed in the CISA KEV catalogue. Attackers only need to be authenticated, meaning that compromised or legitimately granted Subscriber accounts are sufficient to exploit the flaw, after which file deletion can be performed via the plugin’s interface.