The delete_locations_backup_file_callback function in the WP Foodbakery plugin (versions up to and including 4.9) performs insufficient validation of the file path supplied by the AJAX request. This flaw allows an authenticated user with subscriber-level access or higher to specify any file path on the server and delete the target file. Because the caller can choose critical WordPress or plugin files such as wp-config.php, the deletion can be used to compromise the site's configuration and potentially achieve remote code execution. The weakness is a classic example of CWE-23, path traversal or manipulation.

WordPress sites employing the Chimpstudio WP Foodbakery plugin version 4.9 or earlier are affected. The vulnerability applies to any user authenticated with at least subscriber privileges. The attack impacts the server file system of the hosted WordPress installation.

The CVSS score of 8.1 classifies the issue as high severity, while the EPSS score of less than 1% indicates a low probability of exploitation in the wild at present. The flaw is not listed in the CISA KEV catalog. Because the vulnerability requires legitimate authentication, the attack vector is likely internal user activity or compromised account credentials. Once the attacker deletes a sensitive file or replaces it, remote code execution can be achieved, making the threat significant if exploited.