CAOS < 4.1.9 - Admin+ Arbitrary Folder Deletion via Path Traversal

The plugin does not validate the cache directory setting, allowing high privilege users to use a path traversal vector and delete arbitrary folders when uninstalling the plugin

PoC

As admin, put the following payload in the “Cache directory for analytics.js” setting of the plugin: …/wp-includes, tick the “Remove settings at Uninstall” setting and uninstall the plugin to delete the wp-includes folder