CVE-2025-13391 is a missing authorization vulnerability (CWE-862) in the Uni CPO (Premium) plugin for WooCommerce on WordPress. The issue arises from the lack of a capability check in the 'uni_cpo_remove_file' function, enabling unauthenticated attackers to delete files stored in Dropbox by specifying known file paths. This vulnerability affects all versions up to and including 4.9.60, with a partial patch applied in version 4.9.60. The CVSS 3.1 score is 5.8, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and impact limited to integrity loss without confidentiality or availability impact.

An unauthenticated attacker can delete arbitrary files stored in Dropbox if the file path is known, leading to unauthorized loss of data integrity. There is no impact on confidentiality or availability according to the CVSS vector. The vulnerability could disrupt business operations relying on those files but does not allow data disclosure or system takeover.

The vulnerability was partially patched in version 4.9.60 of the plugin. Users should upgrade to the latest version beyond 4.9.60 once a full patch is released. Until then, restrict access to the affected plugin and monitor for suspicious activity. Patch status is not fully confirmed; check the vendor advisory for current remediation guidance.