This is an unauthenticated arbitrary file deletion vulnerability in the Participants Database plugin for WordPress, affecting versions prior to 2.7.8.5. The plugin exposes a file deletion endpoint that lacks both capability verification (current_user_can()) and nonce validation (wp_verify_nonce()). An unauthenticated attacker can send a single HTTP request to delete any file the web server process can write to.
The impact extends far beyond data destruction. Deleting security plugins creates a privilege escalation pathway — an attacker can remove a firewall or monitoring plugin and then exploit a secondary vulnerability that would otherwise be blocked. Attackers can also corrupt backups, eliminate forensic evidence, or render a site unrecoverable. This transforms the vulnerability from a data-loss issue into infrastructure sabotage.
The CVSS 7.4 rating understates the risk. WordPress powers over 40% of the web, and a single vulnerable plugin grants unauthenticated filesystem access across tens of thousands of sites. The rating likely reflects narrow technical constraints (predictable file paths) rather than the blast radius of weaponization in a plugin ecosystem where security updates are applied slowly or never.
If you run this plugin, upgrade to 2.7.8.5 immediately. Review your access logs for DELETE or POST requests targeting unexpected file paths — the attack signature is distinctive. Treat any plugin with file operations and no visible admin interface as high-risk; these features often ship without security review and persist forgotten on thousands of sites.