A path traversal flaw in the ypromo PT Luxa Addons WordPress plugin lets an attacker craft a file path that the plugin passes to the operating system without proper sanitization. Because the plugin does not enforce a restricted directory, the attacker can delete any file that the web server can reach, potentially removing content, configuration files or even core WordPress files. The impact is loss of data and disruption of site functionality, which falls under CWE-22: Improper Limitation of a Pathname to a Restricted Directory.

WordPress sites that have the PT Luxa Addons plugin version 1.2.2 or earlier installed are vulnerable. The plugin is distributed by ypromo and can appear in any WordPress installation that has not updated past the stated version.

The CVSS score of 7.7 indicates high severity, while the EPSS score of less than 1% suggests a low probability of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog, and no public exploits are known. The likely attack vector is a crafted HTTP request to the plugin's file deletion endpoint, which may not require authentication if the endpoint is exposed or may be accessible to users with sufficient privileges.