An authenticated arbitrary file deletion vulnerability in the Advanced Members for ACF plugin poses a critical risk by potentially allowing attackers to achieve remote code execution on the host server.

The plugin suffers from an improper limitation of a pathname to a restricted directory (CWE-22) within the create_crop function. This flaw allows attackers with Subscriber-level access or higher to delete arbitrary files on the server, which can be leveraged to delete critical files like wp-config.php to facilitate remote code execution.

The vulnerability carries a CVSS score of 8.8, reflecting its high potential for system compromise. Successful exploitation could lead to full site takeover, unauthorized access to sensitive database configurations, and significant operational downtime, posing a severe risk to the integrity and availability of the WordPress environment.

Immediate Action: As there is no confirmed patched version currently available, administrators should immediately deactivate and remove the Advanced Members for ACF plugin until a secure update is released by the vendor.

Proactive Monitoring: Monitor server logs for unexpected file deletion attempts or errors related to the core WordPress configuration files.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block requests targeting the create_crop function or suspicious file path traversal patterns in the plugin directory.

Public Exploit Available: No (exploit_available: unknown)

Given the potential for remote code execution and the high severity score of 8.8, this vulnerability must be treated as a priority. Administrators should prioritize the removal of the affected plugin from all production instances and monitor the vendor repository for security patches. Do not re-enable the plugin until a verified fix is confirmed and deployed.