The Contest Gallery WordPress plugin before version 30.0.7 does not perform per-object capability checks in its post deletion routine. The handler only performs a broad role membership test, permitting any user with the Author role or higher to invoke it. This oversight enables attackers that are legitimate authors to permanently delete any posts, pages, or other content, regardless of ownership, destroying site content and exposing the site to further loss.

The vulnerability affects the Contest Gallery WordPress plugin, versions earlier than 30.0.7. All environments running any of these older releases are at risk. The vendor is unlisted, so the risk applies to all installations of the affected plugin.

The CVSS score is 6.5, indicating a moderate severity. The EPSS score is < 1%, suggesting a low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The flaw can be exploited by any user with Author level or higher by accessing the post_cg_youtube_delete_from_library handler via normal site interactions or crafted requests. The lack of per‑object capability checks allows attackers to target and permanently delete arbitrary posts, pages, and other content regardless of ownership. The potential for complete content loss means the impact remains high, but the low EPSS suggests it may be uncommon for attackers to find or exploit this weakness. The low EPSS score and absence from the KEV catalog do not automatically indicate low risk but suggest limited exploitation evidence. Assuming the attack can be performed from the remote web interface, the likelihood remains significant for sites with many authors.