Improper limitation of a pathname to a restricted directory, a path traversal flaw, allows an attacker to supply a file path that references files outside the intended plugin directory. This flaw can cause the plugin to delete arbitrary files on the server, effectively enabling arbitrary file deletion. The impact is a loss of data integrity and availability, and potentially removal of critical system or website files.

The vulnerability affects the VikBooking Hotel Booking Engine & PMS WordPress plugin from all earlier releases through version 1.8.9 installed by the vendor e4jvikwp. Any WordPress site running a vulnerable instance of this plugin is at risk.

The flaw carries a CVSS score of 8.6, classifying it as high severity. The EPSS score is not available, and the vulnerability is not cataloged in CISA KEV, suggesting no known exploits in the wild to date. However, the path traversal nature means an attacker can trigger the deletion by submitting a specially crafted request to the plugin's file deletion endpoint. Successful exploitation would remove arbitrary files, potentially causing site downtime or data loss. Given the high score and the possibility of remote exploitation, the risk is substantial for sites that have not applied the fix.