CVE-2025-4799 is an absolute path traversal vulnerability (CWE-36) in the WP-DownloadManager plugin for WordPress, affecting all versions up to 1.68.10. It allows authenticated users with Administrator-level privileges or higher to delete arbitrary files on the server due to insufficient directory restriction on file deletion operations. This can facilitate remote code execution if key files such as wp-config.php are deleted. The vulnerability can be exploited in conjunction with CVE-2025-4798 to delete any file within the WordPress root directory, increasing its impact. The CVSS v3.1 base score is 7.2 (High), reflecting network attack vector, low attack complexity, high privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

An attacker with Administrator-level access can delete arbitrary files on the server hosting the WordPress site, potentially leading to remote code execution if critical files are removed. This compromises the confidentiality, integrity, and availability of the affected system. The vulnerability's impact is significant given the potential to disrupt the website and gain further control.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Administrator-level access to trusted users only and monitor for suspicious activity. Consider disabling or removing the WP-DownloadManager plugin if it is not essential.