The Restore Permanently delete Post or Page Data plugin for WordPress is vulnerable to Cross‑Site Request Forgery because the rp_dpo_dpa_ajax_dp_delete_data() function lacks proper nonce validation. This flaw allows an unauthenticated attacker, if they can persuade a site administrator to click a crafted link or URL, to delete posts or pages stored by the plugin. The vulnerability is limited to plugin functionality but results in irreversible data loss for the affected content.

The affected product is the pokornydavid Restore Permanently delete Post or Page Data WordPress plugin, versions 1.0 and earlier. Any WordPress site that has this plugin installed and has not upgraded beyond the vulnerable 1.0 release is impacted.

The CVSS score of 4.3 reflects a low‑severity flaw, and the EPSS score of less than 1 % indicates that active exploitation is currently unlikely. The vulnerability is not listed in CISA’s KEV catalog, and no public exploits have been documented. Nonetheless, because the attack path involves a simple forged request that can be triggered through a malicious link, the risk is low but not negligible. Site administrators should treat this as a low‑priority issue but still address it promptly to prevent potential data loss.