The MaxiBlocks Builder plugin for WordPress suffers from a CWE-22 path traversal vulnerability in the maxi_remove_custom_image_size and maxi_add_custom_image_size functions. This flaw allows authenticated users with low privileges (Subscriber-level and above) to manipulate file paths insufficiently validated by the plugin, enabling arbitrary file deletion on the server. Deleting critical files like wp-config.php can lead to remote code execution. The vulnerability affects all versions up to and including 1.9.2. The CVSS v3.1 base score is 8.1, indicating high severity. No patch or official fix has been documented, and no known exploits have been observed in the wild.

An attacker with Subscriber-level access or higher can delete arbitrary files on the server due to improper path validation. This can result in denial of service or remote code execution if critical files such as wp-config.php are deleted. The vulnerability does not require user interaction beyond authentication and has a network attack vector with low attack complexity. The integrity and availability of the affected system can be severely impacted.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user roles to trusted individuals only and monitor for suspicious activity related to file deletions. Avoid granting Subscriber-level or higher access to untrusted users. Review and harden file permissions on the server to limit the impact of arbitrary file deletions.