CVE-2025-12089 is a path traversal vulnerability (CWE-22) in the Data Tables Generator by Supsystic WordPress plugin. The issue arises from insufficient validation of file paths in the cleanCache() function, enabling authenticated administrators to delete arbitrary server files. This can escalate to remote code execution if key files are removed. The vulnerability affects all versions up to and including 1.10.45. The CVSS 3.1 base score is 6.5, reflecting network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, no confidentiality impact, but high integrity and availability impacts.

An attacker with Administrator-level access can delete arbitrary files on the server, potentially causing denial of service or enabling remote code execution by removing critical files such as wp-config.php. This compromises the integrity and availability of the affected system. There is no indication of confidentiality impact. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Administrator-level access to trusted users only and monitor for suspicious activity related to file deletions. Avoid using affected versions of the plugin if possible.