The FluentCart A New Era of eCommerce plugin is vulnerable to arbitrary file deletion via the deleteFile function because it does not validate the supplied file_path parameter. An attacker who is authenticated as a user with custom-level access or higher can choose any file path and delete it, potentially targeting critical WordPress files such as wp‑config.php, which can provide an avenue for remote code execution. The vulnerability is a direct result of insufficient file path validation, classified under CWE‑22.

WordPress sites running the FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler plugin, any version up to and including 1.6.2, are impacted. The flaw exists in all code paths that invoke the deleteFile function from the plugin’s API routes.

The CVSS score of 8.1 indicates a high severity vulnerability, and the EPSS score is not publicly available at this time, making it unclear how often exploit attempts occur. The vulnerability is not listed in the CISA KEV catalog. The attack requires authenticated access with at least custom-level privileges, and involves sending a crafted request to the API route that triggers the deleteFile operation. Because the attacker can delete any file on the server, the risk to confidentiality, integrity, and availability is significant and could lead to full compromise of the affected website.