The PT Luxa Addons plugin for WordPress contains a path traversal vulnerability that could allow an authenticated attacker to disrupt system availability.

This vulnerability is a path traversal flaw (CWE-22) that allows an authenticated user with low privileges to manipulate file paths, leading to potential arbitrary file deletion. The vulnerability is exploitable via network-based access with low complexity.

The ability to perform arbitrary file deletion poses a significant risk to system stability and data integrity. By deleting critical files, an attacker can trigger a denial of service, rendering the WordPress environment unresponsive or unusable, which directly impacts business operations and service availability. Given the CVSS score of 7.7, this is a high-severity issue that requires prompt attention to prevent operational disruption.

Immediate Action: Since a specific patch version is currently unknown, administrators should immediately disable or uninstall the PT Luxa Addons plugin until the vendor releases a secure update.

Proactive Monitoring: Review web server access logs for suspicious requests containing directory traversal sequences, such as dot-dot-slash patterns, directed toward the plugin directory.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block path traversal attempts to mitigate the risk until the software is updated or removed.

Public Exploit Available: Unknown

Given the high CVSS score and the potential for service disruption, organizations should treat this vulnerability with urgency. If the PT Luxa Addons plugin is not essential, removal is the most effective security measure. If the plugin is required, monitor vendor communications closely for a security patch and apply it as soon as it becomes available.