The BeeTeam368 Extensions Pro WordPress plugin contains a CWE-22 directory traversal vulnerability in the handle_live_fn() function. This flaw allows authenticated users with minimal privileges (Subscriber-level and above) to perform unauthorized file operations outside the plugin's restricted directory. Exploitation can lead to deletion of critical WordPress configuration files such as wp-config.php, enabling attackers to compromise the entire site. The vulnerability affects all versions up to and including 2.3.4. The CVSS 3.1 base score is 8.8, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No patch or official fix has been published yet.

Successful exploitation allows authenticated users with Subscriber-level privileges or higher to delete or manipulate files outside the intended directory, including wp-config.php. This can result in complete site takeover by compromising WordPress configuration and potentially disabling the site. The vulnerability impacts confidentiality, integrity, and availability of the affected WordPress installation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict plugin usage to trusted users only and consider disabling or removing the BeeTeam368 Extensions Pro plugin if possible. Monitor for updates from the vendor and apply patches promptly once available.