A path traversal vulnerability in the Membership for WooCommerce plugin could allow unauthenticated attackers to perform arbitrary file deletion, creating a high risk of service disruption.

This vulnerability is a path traversal flaw (CWE-22) resulting from improper limitation of a pathname to a restricted directory. The attack vector is network-based, and the CVSS vector indicates that it is exploitable by unauthenticated attackers without requiring user interaction.

The ability for an unauthenticated actor to delete arbitrary files on the server presents a severe risk to application availability and data integrity. With a CVSS score of 8.6, the vulnerability is classified as High severity, necessitating prompt attention to prevent potential site outages or the removal of critical configuration files.

Immediate Action: Monitor for updates from WP Swings and apply the security patch for the Membership for WooCommerce plugin as soon as it is released. If no patch is currently available, assess the necessity of the plugin and consider temporary deactivation.

Proactive Monitoring: Review web server logs for suspicious activity, specifically looking for path traversal patterns commonly used to access or delete files outside of the intended web root.

Compensating Controls: Utilize a Web Application Firewall (WAF) to intercept and block malicious HTTP requests that attempt to traverse directories.

Public Exploit Available: Unknown

Due to the critical nature of file deletion vulnerabilities, security teams should treat this as a high-priority item. Ensure that the plugin is updated as soon as a fix becomes available and maintain strict monitoring of file system integrity until the patch is successfully deployed.