The vulnerability exists in the woffice_file_manager_delete() function of the Woffice Core WordPress plugin. Insufficient validation of the file path allows an authenticated user with Contributor-level access or higher to specify arbitrary paths, causing the plugin to delete the target file. This can result in deletion of critical WordPress files, such as wp‑config.php, thereby enabling remote code execution. The flaw is a classic path traversal issue identified as CWE‑22.

The flaw affects all installations of the Woffice Core plugin for WordPress up to and including version 5.4.26. The affected product is the Woffice Core plugin from WofficeIO, deployed on WordPress sites. No other products or versions are listed.

The CVSS score of 6.8 denotes a medium severity vulnerability, while the EPSS score of less than 1% indicates low perceived likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Attackers must be authenticated with at least Contributor privileges, so the attack vector is local. Given the potential for deleting core configuration files, successful exploitation could lead to remote code execution if the attacker removes wp-config.php or similar files. However, the probabilistic exploitation likelihood remains low at present.