The CS Framework plugin for WordPress contains a path traversal vulnerability (CWE-22) in the cs_widget_file_delete() function that fails to properly restrict file paths. This flaw enables authenticated attackers with low-level privileges (Subscriber and above) to delete arbitrary files on the server. Such arbitrary file deletion can facilitate remote code execution by removing or tampering with critical files such as wp-config.php. The vulnerability affects all versions up to 6.9. The CVSS 3.1 base score is 8.8, reflecting network attack vector, low attack complexity, privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. There is no vendor advisory or patch link currently available, and no known exploits in the wild have been reported.

An attacker with Subscriber-level access or higher can delete arbitrary files on the server hosting the vulnerable WordPress plugin. This can compromise the server's confidentiality, integrity, and availability. Deleting critical files like wp-config.php may lead to remote code execution, potentially allowing full system compromise. The vulnerability poses a significant risk to affected WordPress sites using the CS Framework plugin up to version 6.9.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict plugin usage to trusted users only and consider disabling or removing the CS Framework plugin if possible. Monitor vendor channels for updates and apply patches promptly once available.