The vulnerability is a directory traversal flaw in the handle_remove_temp_file() function of the BeeTeam368 Extensions plugin for WordPress. It allows authenticated users with Subscriber-level access or higher to obtain file paths outside the intended upload directory. By exploiting this flaw, an attacker can delete critical files such as wp-config.php, which can lead to a site takeover. The weakness corresponds to CWE-36, illustrating improper validation of file paths.

Systems running the BeeTeam368 Extensions plugin on WordPress with versions up to and including 2.3.4 are impacted. This includes any websites that have installed this plugin in those revisions and maintain WordPress environments where subscriber accounts exist.

The CVSS base score of 8.8 indicates high severity. EPSS indicates a very low probability of exploitation (<1%) but that does not negate the potential impact when subscriber accounts are present. The vulnerability is not listed in CISA KEV. Exploitation requires the attacker to be logged in with at least subscriber privileges, after which a crafted request invoking handle_remove_temp_file() can traverse directories and delete arbitrary files. Once wp-config.php is removed, the remaining user can take full control of the site.