A critical path traversal vulnerability in the Participants Database plugin allows unauthenticated attackers to delete arbitrary files from the host server.

This vulnerability is classified as CWE-22, specifically an improper limitation of a pathname to a restricted directory. An unauthenticated attacker can exploit this flaw to delete files on the server filesystem, potentially causing complete system disruption.

The ability to perform arbitrary file deletion represents a critical risk to business continuity and data integrity. Successful exploitation could lead to the deletion of core system files, configuration files, or database components, resulting in total application downtime and potential loss of data. The CVSS score of 10.0 reflects the extreme severity and the potential for complete system compromise.

Immediate Action: Update the Participants Database plugin to version 2.7.8.4 or later immediately.

Proactive Monitoring: Review web server and application error logs for suspicious file system access patterns or repetitive requests targeting non-public directories.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to block directory traversal sequences, such as dot-dot-slash patterns, in URL parameters.

Public Exploit Available: Unknown

Given the critical CVSS score and the ease of exploitation, this vulnerability poses an immediate threat to any environment hosting the affected plugin. Administrators must prioritize updating to version 2.7.8.4 to resolve the underlying path traversal issue and prevent unauthorized file system modification.