Based on the description, authentication is required with at least Subscriber-level permissions. The vulnerability is an insecure direct object reference that allows such authenticated users to delete arbitrary media attachments. The flaw originates in the profile avatar update function that calls wp_delete_attachment on an attachment ID read from user metadata without verifying ownership. By injecting a crafted value into the avatar meta field, an attacker can poison the metadata and then trigger deletion through a standard avatar upload. The impact is unauthorized loss of media files, which can disrupt site functionality, obscure transaction data, or cause a denial of service.

The flaw affects the Charitable – Donation Plugin for WordPress made by smub, version 1.8.11.1 and earlier. Sites running any of these releases are vulnerable. No other versions are mentioned as affected.

The CVSS score of 4.3 reflects a media‑low risk; the EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated WordPress user with at least Subscriber-level access and involves two steps: first poisoning the avatar metadata and then performing a photo upload. Although it does not lead to code execution or elevated privileges, the ability to delete any attachment represents a significant integrity breach that could be abused for sabotage or to remove evidence.