The Snow Monkey Forms plugin for WordPress suffers from a CWE-22 path traversal vulnerability in the 'generate_user_dirpath' function, which fails to properly restrict file paths. This flaw enables unauthenticated attackers to delete arbitrary files on the server. Deleting critical files such as wp-config.php can facilitate remote code execution. The vulnerability affects all versions up to and including 12.0.3. It is rated critical with a CVSS 3.1 base score of 9.8 (Network attack vector, no privileges required, no user interaction, high impact on confidentiality, integrity, and availability). No patch or vendor advisory is currently available, and it is not a cloud service.

Successful exploitation allows unauthenticated attackers to delete arbitrary files on the affected server. This can compromise server integrity and availability, and potentially lead to remote code execution if critical files like wp-config.php are deleted. The vulnerability poses a critical risk to affected WordPress sites using Snow Monkey Forms plugin versions up to 12.0.3.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider disabling or removing the Snow Monkey Forms plugin to prevent exploitation. Monitor for updates from the vendor or trusted security sources for an official patch or mitigation instructions.