The Custom Fields WordPress plugin, before version 1.5.1, fails to validate a user‑supplied file path before performing deletion. This flaw allows an unauthenticated attacker to delete any file on the web server (for example wp‑config.php) by supplying a crafted path. Removing critical configuration files can lead to a full site takeover, granting the attacker control over the WordPress installation and potentially the underlying server.

Any WordPress site that has the Custom Fields plugin installed in a version earlier than 1.5.1 is affected. No vendor name is provided beyond the plugin identifier, and the flaw exists across all installations of the vulnerable plugin regardless of additional customizations.

Because the vulnerability can be triggered by unauthenticated HTTP requests and does not require any pre‑existing user privileges, the attack vector is straightforward. While the CVSS score is not provided, the potential for complete site compromise and the absence of mitigation in the current versions imply high severity. The EPSS score is unavailable and the flaw is not listed in the CISA KEV catalog, but the lack of protection and high impact warrant immediate attention.