WordPress users running the FoodBakery theme version 4.6 or earlier can delete any file on the server through a flaw in the subscriber file deletion functionality. The flaw allows an attacker to delete arbitrary files without proper authorization checks, leading to denial of service, defacement, or removal of critical application data. The weakness is rooted in improper input validation, identified as CWE‑22.

The affected product is the FoodBakery theme released by Chimpstudio. All installations of version 4.6 and below are vulnerable. Users must verify the version of the theme and note that the payload can target any file within the web root that the web server can delete.

The CVSS score of 7.7 indicates a high severity vulnerability, while the EPSS score is not provided and the issue is not listed in the CISA KEV catalog. Attackers can exploit the flaw remotely after gaining sufficient rights within the WordPress environment, such as an administrator or a user who has file deletion permissions. The modification of the request path can trigger the service to remove any file specified by the victim, potentially disrupting service availability or compromising data integrity.