This vulnerability is a Path Traversal flaw, where an attacker can manipulate the file path used by Bold Grid weForms to delete any file on the underlying system. By sending specially crafted input through the plugin’s interface, an adversary can remove arbitrary files, which can impair site functionality, compromise data integrity, or facilitate further attacks if critical configuration files are deleted.

The flaw affects installations of the Bold Grid weForms WordPress plugin from its initial release through version 1.6.28. All WordPress sites that have not yet upgraded beyond 1.6.28 are susceptible.

The CVSS score of 7.5 indicates a high impact vulnerability; the lack of an EPSS score means current exploitation likelihood is unknown. It is not listed in the CISA KEV catalog, suggesting no widely documented exploits yet, but the straightforward path traversal nature makes it likely that an attacker with web access to the plugin could exploit it. Once exploited, an attacker can delete arbitrary files, potentially causing downtime or data loss.