An arbitrary file deletion vulnerability in the WP Chill Kali Forms plugin allows authenticated subscribers to potentially disrupt system operations.

This vulnerability is an improper limitation of a pathname to a restricted directory (CWE-22), commonly known as path traversal. The flaw allows a subscriber, who possesses low-level authenticated access, to delete arbitrary files on the server hosting the WordPress installation.

Successful exploitation of this vulnerability could lead to significant system instability or downtime if critical configuration or core files are deleted. While the CVSS score of 7.7 indicates a high severity rating, the requirement for low-level subscriber authentication limits the initial attack surface to existing users. However, the impact on availability is severe due to the potential for permanent data loss or service disruption.

Immediate Action: Update the WordPress Kali Forms plugin to version 2.4.19 or later to incorporate the necessary security fixes.

Proactive Monitoring: Monitor server access logs for suspicious file deletion patterns or requests containing path traversal sequences, such as dot-dot-slash patterns.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to block malicious path traversal attempts directed at plugin-specific endpoints.

Public Exploit Available: Unknown.

Given the potential for unauthorized file deletion, administrators should prioritize updating the Kali Forms plugin immediately. Organizations should verify that all plugins are updated to the latest vendor-supplied versions to prevent exploitation of this high-severity path traversal flaw.