CVE-2024-13897 is a path traversal vulnerability (CWE-22) in the Moving Media Library WordPress plugin by katsushi-kawamori, affecting all versions up to and including 1.22. The vulnerability arises from insufficient validation of file paths in the generate_json_page function, enabling authenticated administrators to delete arbitrary files on the server. This can lead to remote code execution if key files such as wp-config.php are deleted. The CVSS 3.1 base score is 6.5 (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H), reflecting network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, no confidentiality impact, but high integrity and availability impacts. No vendor patch or advisory is currently available, and the product is not a cloud service.

An attacker with Administrator-level access can delete arbitrary files on the server hosting the WordPress site. This can disrupt service availability and potentially enable remote code execution if critical files like wp-config.php are deleted. There is no confidentiality impact reported. The vulnerability could lead to significant integrity and availability issues on affected systems.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Administrator-level access to trusted users only and monitor for suspicious activity related to file deletions. Avoid using the affected plugin version in sensitive environments where arbitrary file deletion could cause critical damage.