The vulnerability originates from a missing authorization check in the My Album Gallery WordPress plugin, which allows a user to delete arbitrary files from the server. This flaw is classified as a missing authorization weakness and is identified as CWE-862. An attacker who can interact with the plugin’s deletion functionality may remove critical configuration or media files, leading to data loss, project interruption, or potential disruption of site availability.

Ruhul Amin’s My Album Gallery plugin for WordPress is affected from the initial release through version 1.0.4. Users operating any of these versions are at risk and should consider the plugin’s status in their environment.

The CVSS base score of 6.5 indicates moderate severity, and the EPSS score of less than 1% suggests low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Likely exploitation would require an attacker to reach the plugin’s file deletion endpoint, possibly through a user that has been granted unintended permissions or by an unauthenticated user if the plugin’s access controls are misconfigured. The exact attack vector is inferred from the description of an 'incorrectly configured access control security level'.