The Icons Factory plugin for WordPress contains a flaw where its delete_files() function lacks proper authorization checks and path validation. This permits an unauthenticated user to delete any file on the server by supplying a target path. Removing critical files such as wp-config.php can compromise configuration and enable a malicious actor to take control of the site, resulting in loss of confidentiality, integrity, and availability. The weakness is a classic example of CWE‑285, Unauthorized Access for a Trusted System Component.

All installations of the Icons Factory plugin by the vendor artkrylov running any version up to and including 1.6.12 are affected. The vulnerability applies to any WordPress site that has this plugin enabled, regardless of user role or site configuration.

The CVSS score of 9.8 indicates a critical severity. The EPSS score of less than 1% suggests that exploitation is currently rare, and the vulnerability is not listed in CISA KEV. Nevertheless, the flaw can be leveraged remotely via HTTP requests to the plugin’s delete endpoint, allowing unauthenticated attackers to delete arbitrary files and potentially execute code. The attack vector is inferred to be remote over the web, exploiting the lack of authentication checks in the plugin’s file deletion routine.