In WordPress before 4.7.3 (wp-admin/plugins.php), unintended files can be deleted by administrators using the plugin deletion functionality.
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2017-6816.json"