This vulnerability arises from a missing authorization check in the Mark Winiarski WPLingo plugin, allowing a user to delete content arbitrarily. The weakness is an unauthorized access flaw, classified as CWE‑862, and can compromise the integrity of the site’s data without compromising confidentiality. The attack does not grant code execution or elevate privileges beyond content deletion functionality.

The flaw affects any WordPress site running the WPLingo plugin version 1.1.2 or earlier. No specific WordPress core version is mentioned, so any installation employing a vulnerable plugin instance is at risk.

The CVSS score of 6.5 indicates moderate severity, and the EPSS score of < 1% suggests a low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. The attack vector is likely remote, as an authenticated user with insufficient permissions could trigger deletion requests through the plugin’s exposed interfaces, but formal authentication prerequisites are not detailed; the main risk remains that any user with access could delete arbitrary content.