A critical directory traversal vulnerability in the Assistant for NextGEN Gallery plugin allows unauthenticated attackers to delete arbitrary directories on the host server.

This flaw exists in the /wp-json/nextgenassistant/v1.0.0/control REST endpoint, which fails to properly sanitize input before performing file system operations. An unauthenticated attacker can exploit this to delete directories, leading to a complete loss of service availability.

The ability for an unauthenticated user to delete arbitrary directories presents a high risk to business continuity. Successful exploitation can result in the deletion of critical system files, plugin configurations, or entire application directories, causing significant downtime and requiring extensive manual recovery efforts. Given the CVSS score of 7.5, this vulnerability is classified as High severity due to its potential to cause a total service outage.

Immediate Action: As no patched version is currently confirmed, administrators should immediately deactivate and remove the Assistant for NextGEN Gallery plugin from their WordPress environment until a secure update is released by the vendor.

Proactive Monitoring: Monitor server logs for suspicious requests directed toward the /wp-json/nextgenassistant/v1.0.0/ path, specifically looking for attempts to traverse directories or unusual deletion commands.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block all requests to the /wp-json/nextgenassistant/v1.0.0/control endpoint to prevent exploitation attempts while the plugin remains inactive.

Public Exploit Available: exploit_available (unknown)

Due to the unauthenticated nature of this vulnerability and the potential for total system disruption, immediate removal of the affected plugin is the only effective mitigation at this time. Security teams should prioritize this removal to prevent potential service-disruption attacks, pending further guidance or an official security patch from the developer.