The Envolve Plugin for WordPress, developed by ThemeKalia, contains a path traversal vulnerability (CWE-22) in its file deletion functions 'zetra_deleteLanguageFile' and 'zetra_deleteFontsFile'. These functions fail to properly validate file paths before deletion, allowing unauthenticated attackers to delete arbitrary language files. This vulnerability affects all versions up to and including 1.0. The CVSS 3.1 base score is 5.3 (medium severity), reflecting network attack vector, low complexity, no privileges or user interaction required, and impact limited to integrity (file deletion). No patch or official remediation has been documented, and no exploits are known in the wild.

The vulnerability allows unauthenticated remote attackers to delete arbitrary language files within the plugin's context, causing integrity loss. There is no impact on confidentiality or availability reported. The deletion of language files could disrupt plugin functionality or cause localized feature failures but does not directly lead to system compromise or data leakage.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the Envolve Plugin if file deletion risks are unacceptable. Monitoring for updates from ThemeKalia is recommended. No vendor advisory or patch links are currently available.