An unauthenticated path traversal vulnerability in the Integration Opvius AI for WooCommerce plugin enables attackers to remotely delete or read sensitive server files, posing a critical security risk.

The vulnerability exists in the process_table_bulk_actions() function, which fails to perform authentication checks or path validation on user-supplied input. This allows unauthenticated attackers to manipulate the wsaw-log[] POST parameter to perform path traversal attacks, leading to unauthorized file access or deletion.

The ability to read or delete arbitrary files, such as wp-config.php, can lead to complete site takeover, database credential theft, and permanent data loss. Given the CVSS score of 9.8, this vulnerability is classified as critical, as it requires no user interaction or authentication to achieve full system compromise.

Immediate Action: Since a specific patched version is not confirmed in the provided data, administrators should immediately deactivate and uninstall the Integration Opvius AI for WooCommerce plugin until a fix is verified.

Proactive Monitoring: Review web server access logs for suspicious POST requests containing path traversal sequences or attempts to access restricted configuration files.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block directory traversal attempts and restrict access to the underlying vulnerable plugin endpoints.

Public Exploit Available: Unknown.

This vulnerability presents a severe risk to the integrity and availability of the hosting environment. Because the flaw allows unauthenticated attackers to execute destructive actions on the server, immediate removal of the affected plugin is the only effective way to eliminate the attack surface until the vendor releases a verified security update.