CVE-2024-10470

CVE-2024-10470 describes a critical arbitrary file read and deletion vulnerability in the WPLMS Learning Management System for WordPress, affecting all versions up to and including 4.962. This flaw, stemming from insufficient file path validation and permissions checks, allows unauthenticated attackers to delete arbitrary files on the server, potentially leading to remote code execution. With a CVSS score of 9.8 (CRITICAL), the vulnerability is easily exploitable over the network with low attack complexity and no user interaction required, posing a high risk to confidentiality, integrity, and availability. Despite its severity and high EPSS score, there is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.