This vulnerability allows an attacker to delete arbitrary files on the web server using a path traversal flaw in the MapSVG plugin (versions up to 8.16.1). By supplying filenames that contain directory traversal sequences, the plugin can bypass its intended directory limits and remove any file within the WordPress installation. The resulting loss of critical data or configuration can lead to site downtime, data corruption, or facilitate further compromise. The weakness is a classic pathname traversal weakness (CWE-22).

The affected product is the PT Norther Lights Production MapSVG plugin for WordPress. Any installation using MapSVG version 8.16.1 or earlier is vulnerable; versions 8.16.2 and later contain the fix.

The CVSS base score of 7.7 indicates a high severity, reflecting the potential for destructive impact. No EPSS data is available, so current exploitation likelihood cannot be quantified, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is through the web application layer, where an attacker can supply crafted input to trigger the deletion functionality. This would require the ability to interact with the plugin’s deletion endpoint, but no additional conditions are stated in the CVE data.