The Phrase TMS Integration for WordPress plugin is vulnerable to an unauthorized modification of data due to a missing capability check on the "wp_ajax_delete_log" AJAX endpoint in all versions up to 4.7.5. This flaw allows authenticated attackers with Subscriber-level access or higher to delete log files, resulting in loss of audit data and potentially disrupting compliance or monitoring activities. The weakness is a privilege escalation flaw (CWE‑862).

All versions of the Phrase TMS Integration for WordPress plugin, developed by memsource, up to and including version 4.7.5 are affected. Users running those versions on any WordPress installation are at risk; newer releases are presumed to have the capability check in place.

The CVSS score is 4.3, indicating a moderate impact. The EPSS score is less than 1%, suggesting a low likelihood of exploitation. The plugin is not listed in CISA's KEV catalog. Exploitation requires the attacker to be authenticated with at least Subscriber privileges; the attack vector is likely via the web interface or via crafted AJAX requests to the vulnerable endpoint. Once authenticated, the user can delete arbitrary log files, immediately impacting availability of logging data.