The vulnerability allows an attacker to send an unauthenticated request to the dfrps_ajax_delete_saved_search handler, causing any saved search to be removed from the system. This results in loss of user data and potential disruption of services that rely on these saved searches, but does not provide remote code execution or other system compromise.

WordPress sites running the Datafeedr Product Sets Plugin are affected. Versions up to and including 1.3.24 contain the issue; the code located in functions/ajax.php under the AJAX Handlers component is responsible.

The CVSS score of 5.3 indicates moderate severity. EPSS is not available and the vulnerability is not listed in KEV, but the public exploit demonstrates that the issue can be leveraged remotely from any external host with network access. The lack of authorization checks on the AJAX endpoint makes exploitation straightforward; an attacker can delete saved searches with minimal effort, leading to immediate data loss for users