The flaw is a Path Traversal weakness that allows an attacker to delete arbitrary files from the server. This can destroy critical system files, configuration archives, or website content, effectively disabling the site or compromising data integrity. The vulnerability is identified as CWE‑22 and is documented as a high‑severity issue with a CVSS score of 7.7.

The vulnerability affects AmentoTech’s Taskbot WordPress plugin for all releases up to and including version 6.4. No specific sub‑version information is provided beyond the upper bound of 6.4.

With a CVSS high score of 7.7 and an extremely low EPSS probability (< 1 %), the likelihood of exploitation is quite small at present, and the vulnerability is not listed in the CISA KEV catalog. Nonetheless, the plugin is web‑exposed and likely reachable by an attacker with internet access, so remote exploitation is inferred as the primary attack vector. As the flaw permits direct file deletion, a successful attack would immediately disrupt the affected WordPress site.