The Wptobe-memberships plugin for WordPress contains a flaw in the del_img_ajax_call() function where insufficient file path validation allows users with Subscriber-level access and above to delete any file on the server. This can remove critical configuration files, such as wp-config.php, thereby enabling an attacker to achieve remote code execution. The weakness is identified as CWE‑73.

All installations of the Wptobe-memberships plugin up to and including version 3.4.2 are affected. The vulnerability is present in any WordPress site that has the plugin installed, regardless of other plugins or themes, as long as the user has at least a Subscriber role and the capability to trigger the delete image AJAX call.

The CVSS score is 8.1, indicating high severity. The EPSS score is below 1%, suggesting that, while the exploitation probability is low, the impact would be severe if exploited. The vulnerability is not listed in the CISA KEV catalog. Attackers must be authenticated with Subscriber or higher privileges to trigger the deletion, so the attack vector is local to a logged‑in user’s session. The lack of additional remote access requirements limits quick exploitation but does not eliminate the risk, especially in environments where Subscriber roles are widely granted.