The WooCommerce Designer Pro plugin contains an insufficient file path validation flaw in the wcdp_save_canvas_design_ajax function that permits arbitrary file deletion on the server. This weakness can lead to remote code execution, data loss, or complete site outage by enabling an attacker to delete critical files or replace them with malicious payloads. The vulnerability is classified as CWE-22.

All versions of the WooCommerce Designer Pro plugin by JMA Plugins up to and including 1.9.26 are affected. The plugin is used by the Pricom – Printing Company & Design Services WordPress theme on affected sites.

With a CVSS score of 9.8 the flaw is critical. The EPSS score of 1% indicates a modest likelihood of exploitation, yet the vulnerability is still actionable. It has not been listed in the CISA KEV catalog, but the remote nature of the attack vector—unauthenticated HTTP requests to the plugin’s AJAX endpoint—makes it a practical threat.