The vulnerability arises from improper limitation of a pathname to a restricted directory, enabling path traversal. An attacker can craft a malicious request to the JetFormBuilder media-field preset endpoint, causing the plugin to delete arbitrary files on the server, such as attachments stored in the WordPress uploads folder. This can lead to loss of user data and compromise the integrity of the website, but it does not provide direct code execution.

Affected systems are any WordPress sites running the Crocoblock JetFormBuilder plugin through version 3.6.7.1. All installations that have not yet upgraded remain susceptible.

The CVSS score of 6.5 reflects a moderate severity; because an EPSS score is not available, the current exploitation probability cannot be precisely quantified, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is likely remote, accessed via the web interface, though the description does not specify authentication requirements. Once exploited, the attacker can delete any file the web server can write to, making this a significant integrity concern for site administrators.