A path traversal vulnerability in the Demi WordPress plugin allows unauthenticated attackers to perform unauthorized directory deletions, posing a high risk to system availability.

The plugin contains an improper limitation of a pathname to a restricted directory (CWE-22). An unauthenticated attacker can exploit this flaw to delete arbitrary directories on the WordPress installation, potentially causing significant service disruption.

Successful exploitation allows an attacker to remove critical directories, leading to a complete loss of site functionality or data unavailability. With a CVSS score of 7.5, this high-severity vulnerability highlights the risk of destructive actions that could result in substantial operational downtime and recovery costs.

Immediate Action: Update the Demi plugin to the latest available version beyond 0.0.7 to remediate the directory traversal flaw.

Proactive Monitoring: Review web server logs for suspicious requests targeting the plugin's directory structure or unexpected deletion attempts.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block directory traversal patterns (e.g., ../) in incoming HTTP requests directed at the plugin's path.

Public Exploit Available: No (unknown)

The severity of this issue necessitates immediate attention. Administrators should verify their current plugin version and apply the update immediately to prevent potential service-disrupting attacks.