The CVE exposes an improper limitation on path names within the Spam Protect for Contact Form 7 plugin, allowing an attacker to manipulate file paths and delete arbitrary files on the server. This path traversal weakness is categorized as CWE‑22. A successful exploit would enable a malicious actor to remove critical files, potentially disrupting website functionality or compromising system integrity.

Affected systems include any WordPress site that has the Spam Protect for Contact Form 7 plugin installed with a version up to and including 1.2.9. The plugin is maintained by NYSL and is a common addition for spam protection on Contact Form 7 forms. No other WordPress plugins or core WordPress versions are explicitly impacted by this CVE.

The CVSS score of 6.7 indicates moderate severity. The likelihood of exploitation is low, with an EPSS score below 1 % and no listing in the CISA KEV catalog. The vulnerability is exploitable via a path traversal payload, likely requiring authenticated or unauthenticated access to the plugin’s file handling functionality. Attackers would need to supply a crafted input that bypasses directory restrictions to delete arbitrary files.