A missing authorization check in the opicron Image Cleanup WordPress plugin up to version 1.9.2 allows an attacker to bypass normal access restrictions. This incomplete access control can enable an attacker to delete or otherwise manipulate media library items without permission, compromising the integrity and availability of the site’s content. The weakness is identified as a broken authentication/authorization flaw.

WordPress users who have installed opicron’s Image Cleanup plugin version 1.9.2 or earlier are affected. The vulnerability exists in all releases of the plugin from the earliest available version through 1.9.2.

The CVSS score of 4.3 places this issue in the low‑severity range, and the EPSS score of below 1% suggests a very low probability of exploitation in the wild. It is not listed in the CISA KEV catalog. The likely attack vector is via the WordPress web application where the vulnerable plugin endpoint can be accessed without proper permission checks, allowing local or remote attackers to delete images when they have sufficient access to the site.