This vulnerability (CWE-22) in WPBot Pro Wordpress Chatbot versions <=13.6.5 allows authenticated subscribers to delete arbitrary files due to improper limitation of pathname to a restricted directory (path traversal). The CVSS 3.1 base score is 7.7, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and a complete availability impact without confidentiality or integrity loss. No known exploits are reported in the wild. The vendor has not yet provided an official fix or remediation guidance.

Successful exploitation results in arbitrary file deletion, causing denial of service or disruption of availability on the affected Wordpress chatbot system. There is no direct impact on confidentiality or integrity of data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict subscriber privileges where possible and monitor for suspicious activity related to file operations. Avoid exposing the vulnerable plugin in sensitive environments.