The neoslab Database Toolset plugin suffers from a CWE-22 path traversal vulnerability that permits unauthenticated attackers to delete arbitrary files on the server by exploiting insufficient file path validation. This vulnerability affects all versions up to and including 1.8.4. Successful exploitation can lead to remote code execution by deleting critical files such as wp-config.php. The CVSS 3.1 base score is 9.1, reflecting network attack vector, no privileges required, no user interaction, and high impact on integrity and availability. No patch or official remediation guidance is currently provided, and the product is not a cloud service, so remediation depends on vendor updates or user action.

An unauthenticated attacker can delete arbitrary files on the server hosting the Database Toolset plugin. This can disrupt service availability and compromise server integrity. Deletion of critical files like wp-config.php can enable remote code execution, escalating the severity of the impact. The vulnerability poses a critical risk to affected systems until properly mitigated or patched.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should restrict access to the affected plugin, disable or remove the Database Toolset plugin if possible, and monitor for updates from neoslab. No vendor advisory or patch links are currently provided, so proactive risk mitigation is recommended.