An unauthenticated path traversal vulnerability in the RadiusTheme ShopBuilder Pro plugin allows remote attackers to delete arbitrary files, posing a high risk to application availability.

This vulnerability is a CWE-22 Path Traversal issue, allowing an unauthenticated attacker to interact with the filesystem in an unauthorized manner. By sending malicious requests, an attacker can delete critical files on the server that is hosting the WordPress environment.

The CVSS score of 8.6 indicates a high-severity threat to business operations. Exploitation could lead to immediate service outages, loss of database connectivity, or the deletion of core configuration files, resulting in extensive recovery efforts.

Immediate Action: Monitor the vendor for official security patches and apply them immediately upon release; if no patch exists, consider disabling the plugin.

Proactive Monitoring: Review application logs for suspicious traffic patterns, specifically looking for common path traversal characters such as dot-dot-slash in request parameters.

Compensating Controls: Utilize a Web Application Firewall (WAF) to filter out requests that attempt to traverse directories, providing a temporary layer of defense against potential exploit attempts.

Public Exploit Available: No confirmed public exploit in the available data.

Security teams should prioritize monitoring for updates from RadiusTheme. Given the unauthenticated nature of this flaw, it is critical to minimize the attack surface by ensuring the plugin is either updated as soon as a fix is available or disabled if the risk to the environment is deemed unacceptable.