CVE-2021-25020: 
WordPress vulnerability analysis and mitigation

The vulnerability CVE-2021-25020 affects the CAOS | Host Google Analytics Locally WordPress plugin versions before 4.1.9. The vulnerability was discovered and reported by José Aguilera, and was publicly disclosed on December 1, 2021. This security issue involves a path traversal vulnerability in the plugin's cache directory setting functionality (WPScan).

The vulnerability is classified as a path traversal (CWE-22) issue with a CVSS score of 6.5 (medium severity). The security flaw stems from the plugin's failure to properly validate the cache directory setting, which can be exploited through path traversal vectors. This vulnerability falls under the OWASP Top 10 category A1: Injection (WPScan).

When exploited, this vulnerability allows high-privilege users to delete arbitrary folders during the plugin uninstallation process. This could potentially lead to the deletion of critical WordPress system files and directories, affecting the website's functionality (WPScan).

The vulnerability has been fixed in version 4.1.9 of the CAOS plugin. Users are advised to update to this version or later to mitigate the security risk (WPScan).