Missing authorization in the Neon Channel Product Customizer Free plugin version 2.0 or earlier enables an attacker to delete arbitrary content from a WordPress site. The flaw arises because the plugin’s access control checks are incorrectly configured, allowing users to invoke deletion functions without proper privilege verification. According to CWE‑862, this is an Authorization vulnerability that can compromise the integrity and availability of website data.

The vulnerability affects the vertim Neon Channel Product Customizer Free plugin for WordPress, specifically all releases from the initial version through version 2.0. No later versions are listed as affected, so sites using a patched version (2.1 or newer) are not impacted.

The CVSS score of 7.5 classifies this issue as high severity, while the EPSS score of less than 1% indicates that exploitation is currently unlikely. It is not catalogued in CISA’s KEV. The likely attack vector would involve a user with any authenticated WordPress session accessing the plugin’s deletion endpoints, but because the authorization checks are missing, an attacker can delete content without proper permission. Once the vulnerability is exploited, the attacker can remove posts, pages, or custom post types, potentially disrupting site operation.