This vulnerability is an authorization bypass denoted by CWE-639 that allows an attacker to delete arbitrary content from the WordPress site. By supplying a crafted key through the BP Email Assign Templates plugin, the attacker can trigger the plugin’s deletion functionality without proper access checks, causing data loss. The flaw arises from incorrect configuration of access control security levels in the plugin’s code base.

This issue affects the WordPress plugin BP Email Assign Templates developed by shanebp. Versions up through 1.7 are impacted. The plugin is typically installed on WordPress sites that use the BP Email Assign Templates by shanebp plugin, and only versions 1.7 and earlier are vulnerable.

The CVSS score of 6.5 places this bug in the moderate severity range, while the EPSS indicates a very low but nonzero exploitation probability (<1%). It is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker who can interact with the plugin’s interface and supply a specific user-controlled key may bypass authorization checks and delete content, though no public exploitation is documented at this time.