The WooCommerce Purchase Orders plugin for WordPress contains a path traversal vulnerability (CWE-22) in the delete_file() function that fails to properly restrict file paths. Authenticated attackers with Subscriber-level privileges or higher can exploit this flaw to delete arbitrary files on the server. This can result in significant impact, including potential remote code execution if critical files like wp-config.php are removed. The vulnerability affects all versions up to and including 1.0.2. The CVSS 3.1 base score is 8.1, indicating a high severity vulnerability with network attack vector, low attack complexity, and privileges required at the subscriber level. No patch or official remediation guidance is currently available from the vendor.

An attacker with authenticated access at Subscriber level or above can delete arbitrary files on the server hosting the vulnerable WooCommerce Purchase Orders plugin. This compromises the integrity and availability of the system and can lead to remote code execution if key files such as wp-config.php are deleted. The vulnerability does not impact confidentiality directly but severely affects system integrity and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict plugin access to trusted users only and consider disabling or removing the plugin if possible. Monitor vendor communications for updates on patches or temporary mitigations.