The Database Cleaner plugin contains a flaw that allows an attacker with Administrator credentials to delete any database table, including core WordPress tables, because the API does not enforce table name restrictions. This lack of authorization control (CWE‑284) results in immediate data loss and site corruption, potentially rendering the WordPress instance unusable. The vulnerability can be exploited by sending deletion requests to the plugin’s REST endpoint with arbitrary table names.

The issue affects the Database Cleaner plugin for WordPress, version 1.4.7 and all earlier releases, supplied by tigroumeow under the name “Cleanup, Optimization & Repair”. Any WordPress site that has installed one of these plugin versions is vulnerable; the flaw is independent of the underlying operating system or database engine as long as WordPress and the plugin are present.

With a CVSS score of 8.7 the flaw is considered high severity. The EPSS score is unavailable, and the vulnerability is not listed in the CISA KEV catalog, indicating no known public exploitation. The likely attack vector is authenticated access with Administrator‑level permissions; based on the description, it is inferred that credential compromise could result from brute‑force attacks, credential reuse, or social engineering. Once authenticated, an attacker can call the deletion endpoint and supply any table name, leading to permanent loss of site data across the entire WordPress installation.