A critical vulnerability in the Order Tip for WooCommerce plugin allows authenticated users to perform unauthorized arbitrary file deletions, potentially leading to a full site compromise.

This flaw involves an improper check of file paths and user capabilities (CWE-73), which permits users with the Shop Manager role or higher to delete critical server files. The vulnerability requires the attacker to be authenticated as a user with at least Shop Manager privileges.

The ability to delete arbitrary files poses a severe risk to business continuity and data integrity. An attacker could remove essential application files or configuration data to disable the site (Denial of Service) or manipulate the environment to achieve remote code execution. Given the CVSS score of 8.7, this vulnerability is classified as High severity and represents a significant threat to the availability and integrity of the WordPress installation.

Immediate Action: Update the Order Tip for WooCommerce plugin to version 1.6.0 or higher immediately.

Proactive Monitoring: Monitor server logs for suspicious file deletion requests or unauthorized access patterns involving the plugin directory.

Compensating Controls: Implement a Web Application Firewall (WAF) to block requests attempting to traverse directories or access sensitive system paths.

Public Exploit Available: No (exploit_available: false)

Organizations using the Order Tip for WooCommerce plugin must prioritize patching to version 1.6.0 to eliminate this file deletion vector. If an immediate update is not feasible, administrators should restrict plugin access or disable the plugin until a secure version is deployed to prevent potential site takeover.