The vulnerability in the Ultimate WordPress Auction Plugin permits authenticated users with Contributor-level access or higher to perform unrestricted deletions of auctions, posts, and pages. By exploiting a missing authorization check, an attacker can invoke the plugin’s deletion routines and eliminate any content the user is able to view, disrupting site operations and potentially eroding user trust. The flaw does not provide direct code execution but enables significant data loss and site integrity compromise.

WordPress sites that have the Ultimate WordPress Auction Plugin installed, versions 4.2.9 and earlier. The plugin is distributed by nitesh_singh and is commonly used to manage online auctions. Any site enabling Contributor roles or higher without restricting plugin‑provided delete actions is vulnerable.

The CVSS score of 5.4 reflects a moderate severity, and the EPSS score of less than 1% indicates a low likelihood of widespread exploitation at this time. The vulnerability is not listed in CISA’s KEV catalog. An attacker must first authenticate to the WordPress site with a role of at least Contributor, then employ the plugin’s deletion endpoints. Once authenticated, the attacker can delete arbitrary content, causing loss of auctions, posts, or pages. The risk is limited to sites with the vulnerable plugin, but the loss of content can be operationally disruptive, especially for high‑traffic auction platforms.