This vulnerability (CWE-22) in Advanced Product Fields Extended for WooCommerce (<= 3.1.6) allows unauthenticated attackers to perform arbitrary file deletion by exploiting improper pathname restrictions. The flaw enables path traversal attacks that bypass directory restrictions, leading to deletion of files outside intended directories. The CVSS 3.1 score is 8.6 (high severity) with network attack vector, low attack complexity, no privileges required, no user interaction, and scope changed. No patch or remediation information is provided in the available data.

Successful exploitation results in arbitrary file deletion without authentication, which can cause denial of service or loss of critical files affecting the availability of the affected system. There is no indication of confidentiality or integrity impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected plugin and monitor for suspicious activity related to file operations. Avoid exposing vulnerable endpoints publicly if possible.