The WPBot Pro Wordpress Chatbot plugin suffers from an arbitrary file deletion vulnerability (CWE-73) due to inadequate validation of file paths in the qcld_openai_delete_training_file() function. Authenticated attackers with low-level privileges (Subscriber or above) can exploit this flaw to delete arbitrary files on the server. Deletion of sensitive files such as wp-config.php can facilitate remote code execution, escalating the impact from file deletion to full server compromise. This vulnerability affects all plugin versions up to and including 13.6.2. The CVSS v3.1 base score is 8.1, reflecting network attack vector, low attack complexity, required privileges, no user interaction, unchanged scope, no confidentiality impact, high integrity impact, and high availability impact. No vendor patch or official fix has been disclosed yet.

An attacker with Subscriber-level access or higher can delete arbitrary files on the server hosting the WordPress site via the vulnerable plugin function. This can disrupt site availability and integrity. Deleting critical files such as wp-config.php can lead to remote code execution, potentially allowing full server compromise. The vulnerability does not impact confidentiality directly but has high integrity and availability impacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict authenticated user roles to trusted individuals only and monitor for suspicious file deletion activity related to the plugin. Consider disabling or removing the WPBot Pro plugin if possible to mitigate risk.