The LWS Cleaner WordPress plugin contains a flaw in the lws_cl_delete_file function that fails to properly validate file paths. The flaw allows an authenticated user with Administrator-level or higher privileges to delete any file on the server, including critical configuration files such as wp-config.php. Removing such files can lead to immediate compromise of the site or remote code execution, as the attacker can replace them with malicious content. The vulnerability is documented as CWE‑36, an absolute path traversal weakness.

WordPress users running the LWS Cleaner plugin, version 2.4.1.3 or earlier, are affected. The problem is absent only in releases newer than 2.4.1.3.

The CVSS score of 7.2 indicates a high severity when Administrative credentials are compromised. With an EPSS score of 2%, the probability of exploitation is low but non‑negligible, and the vulnerability is not currently listed in the CISA KEV catalog. Attackers need authenticated access at the Administrator level; there is no known unauthenticated vector. The risk is concentrated in environments where strong admin privileges are shared or where credentials could be obtained via phishing or credential stuffing.