CVE-2025-8575 is an absolute path traversal vulnerability (CWE-36) in the LWS Cleaner WordPress plugin by aurelienlws, affecting all versions up to 2.4.1.3. The vulnerability arises from inadequate validation of file paths in the 'lws_cl_delete_file' function, allowing authenticated users with Administrator privileges to delete arbitrary files on the server. This can lead to critical impacts such as remote code execution if key files like wp-config.php are deleted. The CVSS 3.1 base score is 7.2, reflecting network attack vector, low attack complexity, high privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No patch or vendor advisory is currently available, and no exploits are known in the wild.

An attacker with Administrator-level access can delete arbitrary files on the server due to insufficient path validation. This can compromise server integrity and availability, and may lead to remote code execution if critical files are deleted. The vulnerability affects confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Administrator access to trusted users only and monitor for suspicious activity related to file deletions within the LWS Cleaner plugin. Avoid using the plugin in environments where such access control cannot be guaranteed.