The BeeTeam368 Extensions Pro plugin for WordPress contains a directory traversal flaw in its handle_live_fn() routine. An attacker who can authenticate to the site with a Subscriber level role or higher can reference files outside the plugin’s intended directory. This allows deletion of critical WordPress files, most notably wp-config.php, which could facilitate further compromise of the site. The weakness aligns with CWE‑22, a classic directory traversal error.

BeeTeam368’s BeeTeam368 Extensions Pro plugin for WordPress is affected in all releases up to version 2.3.4. Any WordPress site that has not upgraded beyond 2.3.4 is vulnerable.

The CVSS score of 8.8 classifies this flaw as high severity, indicating significant potential impact. The EPSS score of less than 1% suggests current exploitation activity is low, and the vulnerability is not listed in CISA’s KEV catalog. Because the attacker only needs a legitimate Subscriber‑level account, many sites could be exposed. The typical attack vector is via authenticated access to the plugin’s live function, assuming the user role has permission to trigger handle_live_fn.