The Vanquish User Extra Fields WordPress plugin allows path traversal that can be used to delete arbitrary files on the hosting server. This flaw is a classic instance of CWE22, giving an attacker the ability to remove any file the web server process can access, potentially crippling site functionality or deleting sensitive data.

The vulnerability exists in all releases of the vanquish User Extra Fields plugin up to and including version 17.0. No other products or vendors are affected according to the CNA information.

The CVSS score of 8.6 indicates a high severity attack with a large impact if exploited. The EPSS score of less than 1% suggests that attackers are unlikely to target this flaw at the moment, and it is not listed in CISA’s KEV catalog. Nevertheless, the most likely attack vector is through the web interface or configuration files, where a user with CMS access can supply a malformed path to trigger the deletion. If exploited, the attacker can delete arbitrary files, leading to site downtime or data loss.