The vulnerability allows an attacker to craft requests that bypass the Energox theme’s file handling logic and delete any file located within the web root. This leads to loss of critical site data or configuration files, directly compromising the integrity and availability of the WordPress installation.

Any WordPress site using the designingmedia Energox theme version 1.2 or earlier is affected. The theme itself is the only component that handles file deletion and relative paths, so other plugins or themes are not implicated.

The issue carries a high severity rating and a low observed exploitation probability; exploitation would require the attacker to trigger the theme’s file deletion functionality, likely through a crafted URL or form submission. The vulnerability is not listed in CISA’s Known Exploited Vulnerabilities list, which suggests it is not a widely deployed, actively exploited flaw. Because it results in arbitrary deletion of server files, successful exploitation would allow denial of service or further compromise of the site.