CVE-2025-4828 is a critical path traversal vulnerability in the Support Board WordPress plugin (versions up to 3.8.0). The vulnerability exists due to improper limitation of pathname inputs in the sb_file_delete function, allowing attackers to delete arbitrary files on the server. This can lead to remote code execution if key files like wp-config.php are deleted or manipulated. The vulnerability can be exploited unauthenticated and may be leveraged in conjunction with CVE-2025-4855 for exploitation. No official patch or remediation guidance is currently provided in the available data.

Successful exploitation allows an unauthenticated attacker to delete arbitrary files on the server hosting the vulnerable plugin. This can result in complete compromise of the WordPress site, including remote code execution and potential full server takeover. The critical CVSS score (9.8) reflects the high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to restrict access to the vulnerable plugin, disable or remove the Support Board plugin if not essential, and monitor for updates from the vendor. Avoid exposing the plugin to untrusted users or networks.