CVE-2026-59542 is a path traversal vulnerability (CWE-22) in WP Chill Kali Forms affecting versions up to 2.4.18. It allows authenticated subscribers to perform arbitrary file deletion on the affected system. The vulnerability results in a high impact on availability but does not affect confidentiality or integrity. The CVSS 3.1 base score is 7.7, reflecting network attack vector, low attack complexity, required privileges at the subscriber level, no user interaction, and scope change. No vendor advisory or patch information is currently available to confirm remediation status.

The vulnerability enables authenticated subscribers to delete arbitrary files, causing denial of service or disruption of availability of the affected system. There is no direct impact on confidentiality or integrity according to the CVSS vector. This could lead to service outages or data loss depending on which files are deleted.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict subscriber privileges where possible and monitor for suspicious file deletion activities. Avoid exposing the vulnerable versions in production environments.