Javo Core for WordPress contains a missing authorization flaw that allows a user to delete arbitrary content. The plugin’s delete functionality is not properly restricted, giving an attacker the ability to remove posts, pages, or other content that they should not be able to modify. This lack of proper access control is the weakness underlying CWE-862. Based on the description, it is inferred that an attacker who can authenticate to the WordPress site—using a compromised or low‑privilege account—could invoke this flaw to delete content and cause data loss or site instability.

Javo Core plugin by javothemes is vulnerable in all releases from the initial version up through 3.0.0.529. WordPress sites that run any of these affected plugin versions are at risk.

The CVSS score of 7.5 marks the vulnerability as high severity, while the EPSS score of less than 1% indicates a low probability of exploitation. The flaw is not listed in the CISA KEV catalog. Exploitation would most likely target users who have authenticated to the platform but lack appropriate deletion permissions, and the attack would use the plugin’s delete capability to remove content. No public exploit has been documented as of the current data.