The vulnerability permits authenticated users with Author-level access to delete arbitrary files from the site’s uploads directory, which could lead to loss of content and disruption of site functionality. This weakness arises from insufficient validation of the file path and a missing authorization check in the file deletion handler. The flaw is classified as CWE-862, Missing Authorization.

It exists in all releases of the Media Library Assistant plugin up to and including version 3.27. The plugin is a WordPress add‑on that stores media in /wp-content/uploads, making the full set of WordPress sites that have an unaudited update vulnerable. The plugin is managed by the vendor dglingren.

The CVSS score of 4.3 indicates a moderate impact, while the EPSS score of less than 1% suggests exploitation is unlikely against the general population. The vulnerability is not listed in CISA’s KEV catalog. Attackers need authenticated access with Author or higher privileges, so the attack vector is internal or via compromised credentials. The lack of hard‑coded access controls in the deletion routine allows the attacker to supply a path that deletes arbitrary files in the uploads tree.