The Madara - Core plugin for WordPress contains an insufficient file path validation flaw in the wp_manga_delete_zip() function, allowing any user to delete arbitrary files on the server. This vulnerability is a CWE‑22 type path traversal attack that can be leveraged by an unauthenticated attacker to remove critical files such as wp-config.php, potentially leading to remote code execution. The impact is therefore the loss of confidentiality, integrity, and availability of the affected WordPress installation.

Actors can target any site running the Madara - Core WordPress plugin, all versions from the earliest release up to and including 2.2.3. The affected product is the Madara – Core theme, provided by MangaBooth for WordPress sites.

The vulnerability has a CVSS score of 9.1 and an EPSS probability of 5 %. It is not listed in the CISA KEV catalog. The flaw can be exploited with unauthenticated HTTP requests to the wp_manga_delete_zip endpoint, without any prior authentication or privileged access. Attackers can trigger the deletion by crafting a specially formed file path, bypassing normal PHP file‑system checks.