Technical impact
The vulnerability in vanquish Upload Files Anywhere is a Path Traversal flaw that allows an attacker to bypass directory restrictions and delete any file on the server. This weakness can lead to unauthorized removal of critical files, thereby compromising the website’s integrity and availability. The issue is classified as CWE‑22, indicating improper limitation of a pathname to a restricted directory.
Affected Systems
WordPress sites that have installed the Upload Files Anywhere plugin version 2.8 or earlier are affected. The plugin is available through WordPress and is used by site administrators to manage uploaded files.
Risk and Exploitability
The CVSS score of 8.6 marks this flaw as having high severity. The EPSS score of less than 1% indicates that exploitation is unlikely, but not impossible. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the most likely attack vector involves sending a crafted HTTP request to the plugin’s file deletion endpoint, which may be accessible to authenticated users with permission to manage files. If successful, an attacker could delete arbitrary files, potentially leading to site downtime or loss of essential data.
