The Novarain/Tassos Framework Plugin (plg_system_nrframework) suffers from an improper access control vulnerability (CWE-284) that permits unauthenticated attackers to delete arbitrary files on affected websites. This affects versions 1.0.0 through 6.0.1. The vulnerability is remotely exploitable without any privileges or user interaction, resulting in high impact on system integrity and availability. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No official fix or remediation level has been published by the vendor, and no known exploits have been reported in the wild.

Successful exploitation allows an unauthenticated attacker to delete arbitrary files on the affected system, potentially disrupting website functionality and causing data loss. The vulnerability impacts system integrity and availability severely. There is no indication of confidentiality impact beyond what is implied by file deletion. The critical CVSS score of 9.3 reflects the ease of exploitation and the severity of the impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting access to the affected plugin, disabling the plugin if it is not essential, or implementing compensating controls such as web application firewalls to block malicious requests targeting this vulnerability. Monitor official tassos.gr communications for updates or patches.