The vulnerability in the WordPress WEBO MCP Plugin allows an attacker to delete any file on the system where the plugin is installed. By sending a specially crafted request to the plugin’s deletion endpoint, the attacker can instruct the server to remove files, potentially compromising critical configuration or application files and leading to data loss or service disruption. The weakness is a classic CWE‑22 Path Traversal type error in file handling logic.

All installations of the WordPress WEBO MCP Plugin with versions 3.0.18 or earlier are affected. The plugin is distributed by the vendor phuongwebo and is commonly used to manage WordPress settings via the web interface.

The CVSS score of 6.8 indicates moderate severity, and while the EPSS score is not available, the vulnerability is considered significant because it permits arbitrary file deletion. The plugin operates over HTTP, so the likely attack vector is remote, through the web interface that exposes the vulnerable deletion feature. The vulnerability is not currently listed in the CISA KEV catalog, but it remains a serious risk for systems that have not applied the recommended patch.