Unauthenticated arbitrary file deletion in the WooCommerce Designer Pro WordPress plugin (all versions through 1.9.26) allows remote attackers to wipe every file in a directory of their choosing on the server. Because the vulnerable 'wcdp_save_canvas_design_ajax' handler can be reached with no authentication and no user interaction (CVSS 9.8, AV:N/AC:L/PR:N/UI:N), any site running the plugin with default configuration is exposed; the practical outcomes are data loss and site unavailability, with remote code execution achievable only as a follow-on step if a critical file such as wp-config.php is destroyed and the attacker hijacks the subsequent WordPress reinstallation. No public exploit code has been identified at time of analysis, and the plugin's narrow distribution through the CodeCanyon listing and the Pricom printing-company theme keeps the exposed population small, although EPSS assigns a modest 0.81% (56th percentile) probability of exploitation in the next 30 days.
Unauthenticated arbitrary file upload in the Ovatheme Events Manager plugin for WordPress through version 1.8.5 allows remote attackers to place attacker-controlled files on the web server, with the potential for remote code execution if the uploaded file is served from a PHP-executable path. The flaw sits in the plugin's process_checkout() function, which performs no file type validation, so any anonymous visitor able to reach the event registration/checkout flow can attempt an upload - no credentials or user interaction required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N). Risk is rated 9.8, but exposure is bounded by the plugin's niche installed base, EPSS is modest at 0.76% (54th percentile), and there is no public exploit identified at time of analysis.
Unauthenticated privilege escalation in the WP Freeio plugin for WordPress (all versions up to and including 1.2.21) allows remote attackers to register a new account with the 'administrator' role, granting full control of the affected site. The plugin's process_register() function fails to restrict which roles a self-registering user may request, so supplying a role parameter of 'administrator' during the normal public registration flow is sufficient - the assessed CVSS vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (9.8), requiring no authentication or user interaction. WP Freeio is a commercial ThemeForest item used as a freelance-marketplace theme, and because the vulnerable registration flow is the plugin's core function it is exposed by default rather than under a special configuration; EPSS is low (0.62%, ~48th percentile) and no public exploit code or CISA KEV entry was identified at time of analysis, but the trivial exploitation path makes this a genuine high-priority issue rather than a CVSS-inflated one.