The Custom Post Type plugin for WordPress does not validate a nonce on delete requests, enabling a Cross‑Site Request Forgery attack. An attacker can craft a URL that, when visited by a logged‑in administrator, results in the deletion of one or more custom post types, directly impacting the integrity and availability of the site and potentially turning it into a denial‑of‑service vector.

The vulnerability affects the Custom Post Type WordPress plugin from the vendor farvehandleren, versions 1.0 and earlier. Any user running these versions is susceptible, independent of the overall WordPress installation.

The CVSS score is 4.3, indicating a low severity overall, and the EPSS score is below 1 %, suggesting that exploitation is unlikely in the wild. The vulnerability is not listed in the CISA KEV catalog. Successful exploitation requires the attacker to convince an administrator to click a forged link or otherwise execute the deletion request; therefore, the attack vector is highly user‑dependent. Although no active exploitation has been reported, the potential impact on data integrity warrants prompt remediation.