A missing authorization flaw in the Xylus Themes WP Bulk Delete plugin up to version 1.3.6 allows an attacker to perform bulk deletions of posts, pages, or other content without the necessary permissions. The vulnerability is identified as a broken access control (CWE-862). The impact is a loss of data and potential disruption to a WordPress site's content availability.

WordPress sites using the Xylus Themes WP Bulk Delete plugin with any version from an unknown lower bound up through 1.3.6 are affected. The plugin is hosted in WordPress environments and is listed under the vendor Xylus Themes.

The CVSS score of 4.3 indicates moderate severity, while an EPSS score of less than 1% signals a very low likelihood of exploitation for the current period. The vulnerability is not listed in the CISA KEV catalog. Based on the plugin’s functionality, the likely attack vector is a web‑based request to the bulk delete endpoint, where any user with access to the WordPress site could trigger deletion. No specific environmental prerequisites are stated beyond the presence of the vulnerable plugin version.