The flaw is a missing authorization issue that allows improper use of the Team 118GROUP Agent WordPress plugin to delete content at will. Because the plugin does not enforce sufficient access control checks, an attacker can invoke deletion functions that otherwise should be restricted. The primary consequence is the loss or modification of website content, potentially compromising the integrity of the site.

Any WordPress site running the Team 118GROUP Agent plugin with a version of 1.6.0 or earlier is affected. This includes installations that have not yet upgraded beyond that release.

The vulnerability carries a CVSS score of 7.5, indicating high severity. Its EPSS score is reported as less than 1%, suggesting a low current exploitation probability, and it is not currently listed in the CISA KEV catalog. The likely attack vector is the exploitation of incorrect access control, which may require valid credentials or a misconfigured role. An attacker who gains the requisite privileges could delete arbitrary content without proper authorization checks.