The Crypto plugin for WordPress allows anyone to call the wp_ajax_nopriv_crypto_connect_ajax_process action without authenticating, relying only on a publicly available nonce. This enables an attacker to trigger the crypto_delete_json method and delete JSON files that match the pattern *_pending.json in the wp-content/uploads/yak/ directory. Removing those files destroys data that the plugin uses for its workflow, leading to loss of information and a potential denial of service for functions that depend on these artifacts.

WordPress installations that use the Crypto plugin from the odude vendor and are running any version up to and including 2.22 are affected. Sites that have not upgraded beyond this version and with the plugin enabled on a publicly accessible environment are vulnerable.

The vulnerability carries a CVSS score of 5.3, indicating a moderate severity. Its EPSS score is less than 1 %, suggesting a low probability of current exploitation, and it is not listed in the CISA KEV catalog. Attackers only need to send a crafted AJAX request from any IP address, or even from a browser in which no login is required, because the plugin does not verify the user's identity beyond the nonce. If the site is publicly reachable, the exploit is straightforward to execute.