The Invelity Product Feeds plugin for WordPress contains an arbitrary file deletion vulnerability that allows authenticated administrator level attackers to disrupt service or compromise system integrity.

This vulnerability is caused by a lack of input sanitization in the createManageFeedPage function, which is susceptible to path traversal attacks. It requires an attacker to hold administrator-level privileges and perform a Cross-Site Request Forgery (CSRF) action to trigger the deletion of arbitrary files.

Successful exploitation of this flaw allows an attacker to delete critical files on the underlying server, which can lead to a complete denial of service or the removal of essential configuration files. With a CVSS score of 8.1, the high impact on integrity and availability represents a significant risk to business continuity and operational stability.

Immediate Action: Since a specific patch version is currently unknown, administrators should immediately deactivate and remove the Invelity Product Feeds plugin from their WordPress environments until a secure update is released by the vendor.

Proactive Monitoring: Monitor server logs for suspicious POST requests targeting the createManageFeedPage function or unexpected file deletion activity within the WordPress directory structure.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to block path traversal sequences and verify the origin of administrative requests to mitigate CSRF-based attack vectors.

Public Exploit Available: Unknown.

Given the high severity of this vulnerability and the potential for arbitrary file deletion, users should prioritize the removal of the vulnerable plugin. Administrators must remain vigilant for vendor updates and perform a thorough security audit of their WordPress environment to ensure no unauthorized configuration changes have occurred.