The File Upload to Order WordPress plugin fails to validate a file path taken from attacker‑controlled session data before performing file deletion, allowing an unauthenticated user to delete any file the PHP process can reach; this flaw can remove critical site files and enable a complete site takeover. The weakness corresponds to CWE‑73 (Absolute Path Traversal).

WordPress sites that use the File Upload to Order plugin with any release version before 1.1.4 are affected; no fixed version is listed beyond 1.1.4, so all earlier releases remain vulnerable.

An attacker does not need authentication to trigger the deletion action, and the vulnerability is reachable through crafted session data or request parameters. Based on the description, it is inferred that the plugin performs an unlink or similar operation on the supplied path without restriction, so a relative or absolute path can target arbitrary files. The CVSS score is 10.0, indicating critical severity, but the EPSS score of less than 1% signals that current exploitation attempts are rare; the flaw is not yet catalogued in CISA’s KEV. Nonetheless, the potential impact is severe, as a single successful deletion can wipe out key configuration or code files.