CVE-2021-25020

Name of the Vulnerable Software and Affected Versions CAOS | Host Google Analytics Locally WordPress plugin versions prior to 4.1.9

Description The issue allows high privilege users to use a path traversal vector and delete arbitrary folders when uninstalling the plugin due to the lack of validation of the cache directory setting.

Recommendations For versions prior to 4.1.9, update to version 4.1.9 or later to resolve the issue. As a temporary workaround, consider restricting access to the uninstallation process of the plugin to minimize the risk of exploitation.