The vulnerability is a path traversal flaw that allows an attacker to delete arbitrary files from the server. An attacker who can trigger the vulnerable functionality can remove core website files, configuration files, or other critical assets, potentially leading to site downtime, data loss, or facilitating further compromise. The weakness is classified as CWE-22, improper limitation of a pathname to a restricted directory.

The flaw exists in the flexcubed PitchPrint WordPress plugin versions up to and including 11.1.2. Any WordPress site that has this plugin installed within that version range is susceptible, regardless of the overall WordPress version.

The CVSS score of 7.5 indicates a high severity impact and a moderate complexity attack. The EPSS score of less than 1% suggests that current exploitation rates are low, and the vulnerability is not currently listed in the CISA KEV catalog. Nonetheless, the flaw can be leveraged remotely through the plugin's interface if an attacker can gain the necessary access, exposing the site to potential data loss and downtime.