The ThimPress WP Pipes plugin is vulnerable to an unauthenticated path traversal flaw that allows attackers to delete critical system files, posing a high risk to availability.

This is a path traversal vulnerability (CWE-22) residing in the WP Pipes plugin that permits an unauthenticated attacker to manipulate file paths. By exploiting this flaw, an attacker can delete arbitrary files on the underlying filesystem, potentially leading to a denial of service or the destruction of critical application configurations.

The vulnerability carries a CVSS score of 8.6, indicating a high severity due to the potential for significant service disruption. Successful exploitation allows an unauthenticated actor to perform destructive actions on the server, which could result in permanent data loss or complete site downtime, causing severe reputational and operational damage.

Immediate Action: Since a specific patch version is currently unconfirmed, users should disable or remove the WP Pipes plugin until the vendor releases a secure update.

Proactive Monitoring: Review web server access logs for anomalous requests containing path traversal sequences, such as double dots or encoded directory separators, directed at the plugin endpoint.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block directory traversal patterns and restrict access to the WP Pipes plugin directory if immediate removal is not feasible.

Public Exploit Available: Unknown.

Given the critical nature of path traversal vulnerabilities that allow file deletion, administrators must treat this as an urgent security priority. If the plugin is not essential for business operations, complete removal is the safest course of action until ThimPress provides a verified, patched version.