The vulnerability in VibeThemes WPLMS allows an attacker to use path traversal techniques that bypass directory restrictions, enabling deletion of arbitrary files on the server. This can lead to loss of critical data, site corruption, and potential service downtime. The flaw stems from improper pathname validation and is categorized as CWE‑22.

Runners deploying WordPress with the VibeThemes WPLMS plugin, from the initial release up to and including version 1.9.9.5.4. Any installation of the plugin within this range is susceptible until the component is updated beyond the affected build.

The CVSS score of 8.6 rates this flaw as high severity, while the EPSS score of less than 1% indicates low exploitation probability at present. It is not listed in CISA’s KEV catalog. The likely attack vector is remote web-based, inferred from the plugin’s interface that accepts file paths; an attacker could supply a crafted path to delete files if the plugin endpoint is reachable. No active exploits are reported, but the absence of a mitigation solution in the CNA data means that attackers could still exploit the flaw if the plugin is unpatched.