The All‑in‑one Sticky Floating Contact Form, Call, Click to Chat and 50+ Social Icon Tabs—My Sticky Elements plugin for WordPress contains a missing capability check on its bulk deletion routine. This flaw permits any authenticated user with Subscriber‑level access or higher to invoke the deletion function and permanently erase every contact‑form lead the plugin stores. The resulting loss of data is irreversible and directly impacts the confidentiality and integrity of the site’s lead repository.

WordPress sites running the My Sticky Elements plugin version 2.3.3 or earlier are vulnerable. The plugin is distributed by Premio under the name All‑in‑one Sticky Floating Contact Form, Call, Click to Chat and 50+ Social Icon Tabs. Any installation of a vulnerable version, regardless of the underlying WordPress core version, is at risk.

The CVSS score of 4.3 indicates moderate severity, while the EPSS score of less than 1% implies a low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Attackers must first authenticate to the WordPress site, typically through a valid login, and then send an authorized HTTP request to the plugin’s admin endpoint that triggers the bulk deletion function. With the missing authorization check, the function will execute without further permission verification, leading to immediate and total lead loss.