The vulnerability permits an attacker to delete arbitrary files on the server by exploiting a path traversal flaw in the WebinarIgnition plugin. A path traversal input allows the deletion of any file within the web root, leading to potential loss of configuration data, media, or critical application files. This deletion capability directly endangers the integrity and availability of the website and any services depending on the affected files.

The Bug affects WebinarsIgnition, a product of the Saleswonder Team: Tobias, for all versions prior to 4.08.253. Any WordPress installation that has a version of the plugin older than 4.08.253 is potentially vulnerable. The vulnerability was identified in the plugin’s file deletion functionality, which does not correctly restrict the file path to a permitted directory.

The CVSS score of 9.9 indicates critical severity, while the EPSS score is not available, meaning there is no publicly documented exploitation likelihood at this time. The plugin is typically exposed through a public web interface, so a remote attacker could potentially exploit the flaw without authentication. The lack of a KEV listing suggests no current publicly reported active exploitation, but the high severity and lack of safeguards still present a considerable risk. Failing to patch could allow attackers to delete essential files, causing significant service disruption.