The WC Wallet plugin for WordPress contains a missing authorization flaw that permits deletion of any content. The vulnerability stems from the delete function lacking proper access‑control checks, enabling anyone who can invoke that endpoint to remove posts, pages, or product listings. This causes a loss of data integrity and can disrupt the normal operation of the site.

Any WordPress installation that uses the hemnathmouli WC Wallet plugin version 2.2.0 or earlier is affected. The flaw is confined to the plugin itself; no specific WordPress core or server components are mentioned.

The CVSS score of 6.5 indicates a moderate severity, yet the EPSS score of less than 1% shows a very low current likelihood of exploitation. The vulnerability is not listed in CISA KEV, suggesting limited public exploitation to date. An attacker would need to discover or guess the deletion endpoint—likely via authenticated plugin management, or possibly via a crafted HTTP request—making targeted exploitation feasible if insufficient privileges are enforced.