A missing authorization check in the WP Lead Capturing Pages plugin allows an attacker with sufficient access to delete arbitrary content entries. This flaw can lead to loss or tampering of user‑submitted data, potentially impacting the integrity and availability of the site’s content. The weakness is a classic example of improper authorization (CWE‑862).

The vulnerability affects the WP Lead Capturing Pages plugin developed by kamleshyadav. All versions prior to 2.6 are susceptible; the issue is present from the earliest release through <2.6.

The CVSS score of 7.5 indicates a high severity for this flaw, while the EPSS score of less than 1% suggests that, so far, exploitation is rare. It is not listed in the CISA KEV catalog. Based on the description, the likely attack vector involves issuing a delete request through the plugin’s management interface, typically requiring an authenticated user with elevated privileges. An attacker who can gain such access—either by credential compromise or social engineering—can trigger the deletion, resulting in loss of content. The combination of a solid exploitation path and high severity underlines the need for timely remediation.