The vulnerability allows unauthenticated users to submit a file path that is not properly sanitized, and the plugin’s single‑pass traversal filter can be bypassed. When a later permanent deletion is triggered, an arbitrary file outside the uploads directory—such as wp-config.php—can be removed, resulting in immediate service disruption or full site takeover. The impact is thus both to availability and to confidentiality and integrity of the site. The weakness is a classic path traversal flaw.

WordPress sites running the Shared Files plugin before version 1.7.67 or the shared-files-pro plugin before version 1.7.68 are affected.

The issue can be exploited without authentication and requires only the ability to trigger a file deletion request, making it highly accessible. The CVSS score is 6.8, and the EPSS score is < 1%, indicating a low but non‑zero probability of exploitation. It is not listed in the CISA KEV catalog. Given the lack of authentication constraints and potential for critical file removal, the risk remains high. An attacker could place a deletion request referencing a sensitive file, leading to its permanent removal when the deletion flow runs.