The vulnerability is a Path Traversal flaw that allows an attacker to delete arbitrary files from the server. Because the plugin does not properly restrict uploaded CSV filenames, an attacker can craft a filename containing traversal sequences such as "../" and then trigger the import export process to remove any file in the file system. This results in a breach of integrity and availability, potentially removing critical configuration or application files.

The flaw affects WordPress users who have installed the WooCommerce csv import export plugin by Extendons, versions up to and including 2.0.6. Any deployment that has an upgrade path to a later 2.0.x release will no longer be vulnerable.

The CVSS score is 7.7, indicating a high impact severity. The EPSS score of less than one percent suggests that real‑world exploitation is unlikely at present, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is through the plugin’s import or export functionality, which can be accessed by users with sufficient permissions. An attacker who can trigger the import/export flow could delete critical server files, but would need appropriate access to the WordPress admin interface or to exploit the upload feature to input the malicious path.