The Squeeze WordPress plugin before version 1.8.1 fails to perform a capability check on its AJAX action "squeeze_restore_attachment", which reverts an attachment to its backup copy or permanently deletes that backup and the plugin’s generated WebP derivatives. Because the check is missing, any authenticated user, including those with the lowest role of Subscriber, can trigger this action regardless of ownership of the attachment. The result is unauthorized modification or removal of media files stored on the site, potentially leading to data loss, visual inconsistencies, and content integrity issues.

WordPress sites installing the Squeeze plugin with a version older than 1.8.1 are affected. Any deployment of the plugin prior to the stated release, irrespective of site size or configuration, is vulnerable.

With a CVSS score of 5.4, the vulnerability presents a moderate severity. Exploitation requires only that the site runs an affected version of Squeeze and that the attacker has authenticated access at the Subscriber level. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is local: a legitimate user can trigger the vulnerable AJAX endpoint, making the risk largely dependent on the number of Subscriber accounts and how prominently the site relies on the plugin’s attachment functionality.