An unauthenticated path traversal vulnerability in the vanquish WooCommerce File Approval plugin allows remote attackers to delete files on the host server, creating a high risk of service disruption.

The plugin fails to correctly sanitize user input, allowing an unauthenticated attacker to perform path traversal attacks. This flaw allows the attacker to specify file paths and delete sensitive files, which can effectively break the WordPress installation.

The vulnerability carries a CVSS score of 8.6, reflecting the high risk to availability and system integrity. Successful exploitation could result in total site failure, requiring manual restoration from backups and causing significant downtime for e-commerce operations.

Immediate Action: Check for and apply any available vendor updates for the WooCommerce File Approval plugin; if no update is available, consider deactivating the plugin until a fix is released.

Proactive Monitoring: Monitor server integrity and logs for unauthorized file modification or deletion events that deviate from normal operational patterns.

Compensating Controls: Deploy a Web Application Firewall (WAF) to detect and block malicious requests containing path traversal payloads directed at the vulnerable plugin endpoints.

Public Exploit Available: No confirmed public exploit in the available data.

Administrators should treat this vulnerability with high urgency. If an official patch is not yet available, the most effective mitigation is to disable the plugin entirely to prevent unauthorized file deletion until the vendor provides a secure version.