The Aeropage Sync for Airtable plugin for WordPress has a missing capability check in the aeropageDeletePost function. This flaw allows any authenticated user with Subscriber role or higher to delete arbitrary posts. The deletion removes content permanently, leading to loss of data. The weakness is classified as CWE-862: Missing Authorization Check. No remote code execution or elevation is possible, but the ability to remove posts can disrupt site integrity and availability.

The vulnerability affects the Aeropage Sync for Airtable WordPress plugin for vendors aeropage. Version 3.2.0 and all earlier releases are impacted. Site owners using this plugin on WordPress installations should verify their plugin version. The plugin is currently listed as aeropage:aeropage_sync_for_airtable in CPE. The specific impact is limited to sites running WordPress with the plugin installed.

The CVSS score is 4.3, indicating moderate severity. EPSS <1% suggests that the probability of widespread exploitation is low at the moment. The vulnerability is not listed in the CISA KEV catalog. Attackers need only an authenticated account with Subscriber or higher permissions, which is typically available to many users. Exfiltration is not required as the damage is local to the site. Because the plugin does not allow arbitrary code execution, the risk is confined to data loss or site content disruption. Monitoring for unauthorized post deletions and applying a patch are recommended.