The Order Tip for WooCommerce plugin, versions older than 1.6.0, lacks proper authorization checks and path validation for the delete_exported_csv_file_ajax function. This flaw permits any user with the Shop Manager role or higher to delete any file on the server, exposing the site to compromise. The weakness corresponds to improper authorization and incorrect permission assignment, which could allow an attacker to remove critical files or inject malicious ones.

WordPress installations running the Order Tip for WooCommerce plugin, any version below 1.6.0. Users granted the Shop Manager role or higher can trigger the deletion operation.

The CVSS score of 8.7 indicates high severity, and the EPSS score is <1%, meaning exploitation probability is low but not negligible. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated session with Shop Manager or higher permissions, implying that only internally privileged users can mount the attack. The lack of path restrictions means that a single deletion request can target arbitrary server files, raising the risk to both confidentiality and integrity. Monitoring for suspicious file deletion activities remains important until a patch is applied.