The plugin lacks a capability check on the delete operation, allowing any authenticated user, such as a subscriber, to delete arbitrary posts and pages. This flaw permits unauthorized content removal and can be used to disrupt site integrity or cover malicious activity. The weakness stems from improper authorization controls, classified as an insufficient privilege check.

Affected installations are WordPress sites running AZEXO Store Locator plugin version 1.4 or earlier. The vulnerability applies to all users with authenticated access, including subscribers, and affects both posts and pages that the plugin manages.

The exploit requires only normal WordPress authentication; an attacker can trigger the deletion through the plugin's manager interface or by crafting a request to the azt_delete_item endpoint. No external code execution is involved, but the damage is significant due to content loss. The EPSS score is not available, and the CVE is not listed in the KEV catalog. The absence of an authorization check makes the vulnerability highly exploitable for any site with exposed subscriber accounts.