File Upload to Order WordPress Plugin Arbitrary File Deletion Vulnerability

The File Upload to Order WordPress plugin before version 1.1.4 contains an arbitrary file deletion vulnerability.

The plugin does not validate or confine a file path taken from attacker-controlled session data before deleting the file. The deletion action is reachable by unauthenticated users.

• Affected versions: before 1.1.4
• Attackers can delete arbitrary files on the server
• Removal of certain files can lead to full site compromise