The Custom Fields WordPress plugin, before version 1.5.1, fails to validate a user‑supplied file path before performing deletion. This flaw allows an unauthenticated attacker to delete any file on the web server (for example wp‑config.php) by supplying a crafted path. Removing critical configuration files can lead to a full site takeover, granting the attacker control over the WordPress installation and potentially the underlying server.

Any WordPress site that has the Custom Fields plugin installed in a version earlier than 1.5.1 is affected. No vendor name is provided beyond the plugin identifier, and the flaw exists across all installations of the vulnerable plugin regardless of additional customizations.

Because the vulnerability can be triggered by unauthenticated HTTP requests and does not require any pre‑existing user privileges, the attack vector is straightforward. The inference that the likely attack vector is via unauthenticated HTTP requests is derived from the description. The CVSS score is 10, indicating the highest severity; the EPSS score is < 1% and the flaw is not listed in the CISA KEV catalog, but the lack of protection and high impact warrant immediate attention.