The MaxiBlocks Builder plugin for WordPress has an insufficient file ownership check on the maxi_remove_custom_image_size AJAX action. This flaw allows an authenticated user with Author level or higher to delete any file in the wp-content/uploads directory, including those uploaded by other users and administrators. The deletion removes critical media assets, potentially disrupting site functionality and compromising content integrity. The weakness is categorized as CWE‑639, which is an authorized access vulnerability.

All installations of the MaxiBlocks Builder plugin for WordPress up to and including version 2.1.8 are affected. The issue is present in every release through 2.1.8; any site still using those releases is susceptible.

The CVSS score of 5.3 indicates moderate severity, and the EPSS score of less than 1% suggests a low probability of exploitation in the wild. The vulnerability is not currently listed in the CISA KEV catalog. Exploitation requires the attacker to be an authenticated User with Author role or higher, so an attacker must first obtain a user account with sufficient permissions before deleting files. The attacker can target any media file without needing additional privileges, making the impact widespread for sites with many Uploads.