The Counter live visitors for WooCommerce plugin is vulnerable because the wcvisitor_get_block function does not properly validate the file path supplied. An attacker who can access the plugin endpoint can therefore delete all files within any directory the server allows, which can lead to loss of critical data or a complete denial of service for the site. The weakness is a classic improper file handling issue.

All installations of the Counter live visitors for WooCommerce plugin built by DanielRiera, specifically version 1.3.6 and earlier, are affected. Older or newer releases after 1.3.6 are presumed not to contain the flaw.

The CVSS score of 8.2 indicates a high severity. The EPSS score of less than 1% shows a very low probability of exploitation in the wild at this time, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be unauthenticated, as the flaw stems from insufficient input validation that does not require user authentication. An attacker could exploit the flaw by making a crafted request to the vulnerable endpoint and specifying a target directory to delete.