The NinjaScanner – Virus & Malware scan plugin contains insufficient file path validation in the 'nscan_ajax_quarantine' and 'nscan_quarantine_select' functions. Administrators or higher‑privileged users can exploit these functions to delete arbitrary files on the server, including files located outside the WordPress root directory. This allows the attacker to modify or remove critical system files, potentially leading to defacement, denial of service, or facilitating further compromise.

The vulnerability affects the NinjaScanner – Virus & Malware scan plugin for WordPress, manufactured by nintechnet. All releases up to and including version 3.2.5 are impacted.

The CVSS score of 7.2 denotes a high severity vulnerability, while the EPSS score of less than 1% indicates a low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires authenticated access at the Administrator level or higher, and the attacker must use the WordPress admin interface to trigger the vulnerable quarantine functions. No public exploits have been confirmed, but the lack of file path checks presents a serious integrity risk for sites running the affected plugin.