The plugin contains a Path Traversal flaw that allows an attacker to delete arbitrary files on the server. This weakness is classified as CWE‑22, meaning the code fails to restrict the pathname passed to system file operations. If exploited, the attacker could remove critical system files, configuration files, or application data, causing loss of data, denial of service, or facilitating further compromise.

The vulnerability affects the ACF Extended WordPress plugin versions from the initial release through 0.9.2.7. Any WordPress installation that has this plugin installed and not upgraded to the fixed version 0.9.2.8 or later is potentially vulnerable. The impact is limited to the filesystem permissions granted to the web server process for the plugin directory and any directories it can reach via traversal.

The CVSS score of 6.5 indicates a moderate severity. The EPSS score is not available, and because the vulnerability is not listed in the CISA KEV catalog, there is no known active exploitation data. The description does not mention authentication requirements, so it is inferred that a remote attacker may trigger the exploit by accessing a crafted URL or form that leads to the deletion logic. In the absence of explicit authentication constraints, the attack is likely feasible from outside, though it typically requires the target’s web server to permit file write operations from the plugin. The risk is therefore moderate with an assumed possibility of remote exploitation if the plugin executes deletion with adequate privileges.