CVE-2025-2004: 
WordPress vulnerability analysis and mitigation

The Simple WP Events plugin for WordPress contains a critical vulnerability (CVE-2025-2004) discovered and disclosed on April 8, 2025. This vulnerability affects all versions up to and including 1.8.17, allowing unauthenticated attackers to perform arbitrary file deletion due to insufficient file path validation in the wpe_delete_file AJAX action (NVD Database).

The vulnerability is classified as an External Control of File Name or Path (CWE-73) issue with a CVSS v3.1 base score of 9.1 (CRITICAL). The vulnerability vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H, indicating network accessibility, low attack complexity, no privileges required, and no user interaction needed (NVD Database).

The vulnerability allows unauthenticated attackers to delete arbitrary files on the server. This capability can lead to remote code execution when critical files, such as wp-config.php, are deleted. The high severity rating reflects the potential for significant system compromise (NVD Database).

The vulnerability is highly exploitable due to its unauthenticated nature and the lack of required user interaction. The affected AJAX action (wpe_delete_file) can be accessed without authentication, making it particularly dangerous (WordPress Plugin).