The Restrict File Access plugin for WordPress allows an attacker without authentication to delete any file on the server by exploiting a missing or incorrect nonce validation on the plugin’s configuration page. The flaw provides a clear pathway for an attacker to remove critical files, such as wp-config.php, which can then be used to hijack the site and execute arbitrary code. The vulnerability is classified as Cross‑Site Request Forgery (CWE‑352).

WordPress sites running the Restrict File Access plugin with a version equal to or older than 1.1.2 are impacted. The vulnerability is vendor specific to the plugin provided by josxha. No other versions or plugins are listed as affected.

The CVSS score of 8.1 indicates a high severity of exploitation. The EPSS score of less than 1% suggests that the overall probability of exploitation in the wild is currently low, but the known vulnerability is not listed in the CISA KEV catalog. Attackers can trigger the vulnerability via a forged link or form submission that lacks proper nonce verification, enabling them to delete arbitrary files. Because the exploit does not require privileged credentials and can be executed by a remote entity, it remains a significant risk to affected sites.