This vulnerability (CVE-2026-28171) affects WooCommerce File Approval versions up to 10.7 and permits unauthenticated attackers to delete arbitrary files on the affected system. The issue is related to improper handling of file paths (CWE-22), enabling path traversal attacks that lead to arbitrary file deletion. The CVSS 3.1 vector indicates network attack vector with low attack complexity, no privileges required, no user interaction, and a scope change. The impact is limited to availability, with no confidentiality or integrity impact reported. There is no information about an available patch or vendor advisory at this time.

Successful exploitation allows an unauthenticated attacker to delete arbitrary files, potentially disrupting service availability. There is no reported impact on confidentiality or integrity. This could lead to denial of service conditions or loss of critical files on the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected WooCommerce File Approval component and monitor for suspicious activity related to file deletion attempts. Avoid exposing the vulnerable component to untrusted networks.