Improper limitation of pathname in the File Upload for WooCommerce plugin allows an attacker to perform path traversal and delete arbitrary files on the WordPress server. A file path supplied through the upload interface is not properly sanitized, enabling removal of any file whose path can be constructed, potentially including critical configuration, log, or system files. The vulnerability is a classic Path Traversal weakness (CWE‑22) that compromises data integrity and may lead to further exploitation if critical files are removed.

The issue affects all installations of the File Upload for WooCommerce add‑on from the vendor add-ons.org, with affected versions ranging from early releases through 2.2.4. Systems running any of these versions are potentially exposed, regardless of the WordPress core or WooCommerce versions.

The CVSS score of 6.8 indicates a moderate impact if exploitation is achieved. The EPSS score (<1%) suggests a low current likelihood of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. Exploitation would likely require access to the plugin’s upload functionality, which is typically available to users with product upload permissions; attackers would construct a filename containing directory traversal sequences to delete target files. Once access is gained, any file in the web directory tree could be removed, creating a denial of service or facilitating further compromise.