The vulnerability is a Path Traversal flaw that allows an attacker to delete any file on the server’s file system via the WZone WordPress plugin. Because the plugin does not properly limit the file pathname to a controlled directory, an attacker can craft requests to point to critical system files, leading to data loss, loss of site functionality, or even facilitating further compromise if the deleted files are essential for running the site.

The issue affects vendors AA‑Team’s WZone plugin for WordPress. All installations using version 14.0.31 or earlier are impacted, regardless of the specific release date listed as ‘n/a through <= 14.0.31’.

The problem carries a CVSS score of 8.8, indicating high severity. Its EPSS score is less than 1%, suggesting a low probability of exploitation in the wild, and it is not currently listed in the CISA KEV catalog. Based on the description, the likely attack vector is remote, via the WordPress plugin interface, allowing an attacker to trigger the deletion of arbitrary files if they can send requests to the vulnerable endpoint.