EIP-2026-113473

This exploit demonstrates an arbitrary file deletion vulnerability in the WooCommerce CSV Importer plugin (v3.3.6) due to improper sanitization of the 'filename' POST parameter. An authenticated user can delete critical files like wp-config.php via a crafted request to admin-ajax.php.