The Microsoft Azure Storage for WordPress plugin contains a missing capability check on the 'azure-storage-media-replace' AJAX action, allowing an authenticated user with a subscriber role or greater to delete arbitrary media attachments by providing a replace_attachment parameter. This weakness is a CWE-862 Missing Authorization defect, enabling unauthorized deletion. The plugin's description explicitly states that users can delete media files from the WordPress Media Library. It is inferred that this deletion could lead to loss or tampering of media assets on the site.

WordPress sites running the Microsoft Azure Storage for WordPress plugin version 4.5.1 or earlier from the vendor 10up are affected. The vulnerability applies to all installations of this plugin version range and does not affect later releases. No additional version details are provided.

The CVSS score of 5.4 indicates medium severity, requiring an authenticated session with at least subscriber-level privileges and access to the exposed nonce. The EPSS score is less than 1%, suggesting a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the attack vector is likely an authenticated user with a subscriber role or higher on the WordPress site. The risk is moderate, but unattended sites could suffer media loss or defacement.