CVE-2024-4347 is a CWE-22 path traversal vulnerability in the WP Fastest Cache WordPress plugin (versions up to 1.2.6). The flaw exists in the specificDeleteCache function, allowing authenticated users with sufficient privileges to delete arbitrary files on the server by manipulating pathnames. This can lead to deletion of critical configuration files such as wp-config.php, potentially impacting site availability and security. The vulnerability is rated high severity with a CVSS 3.1 score of 7.2, reflecting network attack vector, low attack complexity, required privileges, and high impact on confidentiality, integrity, and availability. No patch or vendor advisory is currently available, and the plugin is not a cloud service.

Successful exploitation allows an authenticated attacker with high privileges to delete arbitrary files on the web server hosting the WordPress site. This includes critical files like wp-config.php, which can disrupt site functionality and compromise security. In shared hosting environments, this could affect multiple sites on the same server. The impact affects confidentiality, integrity, and availability of the affected systems.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict plugin access to trusted administrators only and consider disabling or removing the WP Fastest Cache plugin if possible to prevent exploitation.