An unauthenticated path traversal vulnerability in the Custom Fields WordPress plugin enables attackers to delete critical system files and achieve full site takeover.

This vulnerability is caused by a lack of input validation on file paths before deletion processes. An unauthenticated attacker can supply malicious path strings to trigger the removal of sensitive files, such as wp-config.php, leading to complete site compromise.

The ability for an unauthenticated user to delete arbitrary files poses a catastrophic risk to business operations, potentially resulting in complete site destruction and data loss. The CVSS score of 10.0 reflects the extreme severity and the ease with which an attacker can achieve a full system takeover.

Immediate Action: Update the Custom Fields plugin to version 1.5.1 or higher immediately to resolve the path validation flaw.

Proactive Monitoring: Check server filesystem integrity and monitor logs for suspicious file deletion requests or attempts to access configuration files.

Compensating Controls: Ensure the web server process runs with the least privilege necessary, restricting its ability to delete files outside of the expected uploads directory.

Public Exploit Available: No (exploit_available: unknown)

This vulnerability represents an existential threat to any site running the affected plugin. Administrators must verify their plugin version immediately and perform an update to 1.5.1 or later to prevent potential site takeover.