The Order Tip for WooCommerce plugin, versions older than 1.6.0, lacks proper authorization checks and path validation for the delete_exported_csv_file_ajax function. This flaw permits any user with the Shop Manager role or higher to delete any file on the server, exposing the site to compromise. The weakness corresponds to improper authorization and incorrect permission assignment, which could allow an attacker to remove critical files or inject malicious ones.

WordPress installations running the Order Tip for WooCommerce plugin, any version below 1.6.0. Users granted the Shop Manager role or higher can trigger the deletion operation.

No CVSS or EPSS scores are publicly available for this vulnerability, and it is not listed in the CISA KEV catalog. Exploitation requires an authenticated session with Shop Manager or higher permissions, implying that only internally privileged users can mount the attack. The lack of path restrictions means that a single deletion request can target arbitrary server files, raising the risk to both confidentiality and integrity. Monitoring for suspicious file deletion activities remains important until a patch is applied.