Based on the description, it is inferred that the Presto Player Pro plugin includes logic that allows file deletion without adequate checks. When triggered, the plugin removes any file path supplied, potentially deleting database files, configuration, or other critical content. This loss of data integrity and availability maps to CWE‑22, an insecure path traversal or arbitrary file deletion flaw.

This vulnerability exists in the Presto Player Pro WordPress plugin up to and including version 3.0.1. The affected vendor is Presto Player. Users of any WordPress site running these plugin versions are vulnerable until an update to 3.0.2 or later is performed.

Based on the description, it is inferred that the plugin code runs within the web application, allowing an attacker who can submit a deletion request—whether with authenticated access or via a crafted HTTP request—to delete any file on the server that the web user can read, which is typically the site root. The CVSS score of 6.8 indicates a medium severity. Because the EPSS score is not available and the vulnerability is not yet listed in the CISA KEV catalog, there is no evidence of widespread exploitation. Nevertheless, the ability to erase site files remains a serious risk and should be mitigated promptly.