The Attachment Manager plugin for WordPress allows an unauthenticated attacker to delete arbitrary files on the server because the handle_actions() function does not properly validate file paths. This weakness can be exploited to remove any file on the filesystem, including critical configuration files such as wp-config.php, thereby enabling remote code execution or severe loss of data integrity and availability. The vulnerability is identified as CWE‑22 (Path Traversal).

All installations of Aaron Campbell's Attachment Manager plugin version 2.1.2 and earlier are affected, regardless of WordPress version. The vulnerability exists in every plugin instance that includes the handle_actions() routine, meaning any site using a legacy copy of the plugin is at risk.

The CVSS score of 9.1 indicates a high severity and the EPSS score of 9% suggests a non‑negligible likelihood of exploitation in the wild. The vulnerability is not listed in CISA KEV, but the reliability of the attack path—unauthenticated access to a deletion endpoint—means an attacker can upload malicious content or craft a request to delete a target file without requiring authentication or pre‑existing permissions. The exploitation requires only knowledge of the endpoint URL and that the plugin is active, making it readily actionable by automated attackers.