The Portfolio Filter Gallery WordPress plugin fails to perform a per-object authorization check before executing a deletion operation. Consequently, users with the Contributor role or higher can delete any attachment belonging to other users, including those owned by administrators. This flaw allows an authenticated attacker to permanently remove media files, leading to data loss, potential disruption of site operations, and a reduction in content integrity. The vulnerability affects the plugin’s delete attachment endpoint (pfg_delete_video_thumbnail), which is accessible to users with Contributor or higher capabilities. No specific operating system or PHP version is mentioned, so the risk applies to all standard WordPress hosting environments that employ this plugin.

Affected systems include any WordPress installation that has Portfolio Filter Gallery installed with a version earlier than 2.2.1. The vulnerability affects the plugin’s delete attachment endpoint (pfg_delete_video_thumbnail), which is accessible to users with Contributor or higher capabilities. No specific operating system or PHP version is mentioned, so the risk applies to all standard WordPress hosting environments that employ this plugin.

Risk and exploitability are significant from the perspective of any authenticated user. The flaw does not require additional privilege escalation beyond the role granted at login, and it does not rely on user interaction or external input. Although EPSS is not available, the vulnerability is not listed in the CISA KEV catalog, indicating that no publicly known exploit has been reported. Nonetheless, because the deletion path is exposed and the check is missing, it is straightforward for an attacker to trigger the behavior. The CVSS base score is 2.2, but the impact on data integrity and availability, combined with the low barrier to exploitation, warrants immediate remediation.