The PZ Frontend Manager plugin has a missing authorization flaw in the pzfm_user_request_action_callback function. The function accepts an AJAX request with a 'dataType' parameter set to 'delete' and proceeds to call wp_delete_user on all supplied user IDs. Because it omits capability checks and nonce verification, any authenticated user with Subscriber role or higher can invoke the endpoint and delete arbitrary WordPress users, including administrators. This lowers system integrity and can lead to loss of legitimate user accounts and associated data.

WordPress sites that run the PZ Frontend Manager plugin version 1.0.6 or earlier are affected. The plugin is distributed by projectzealous01 and serves as a frontend manager for WordPress sites.

The CVSS score of 5.3 indicates moderate severity. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. An authenticated attacker who can send a crafted AJAX request to the wp_ajax_pzfm_user_request_action endpoint can exploit the flaw. No additional external prerequisites are noted beyond a logged‑in session, and exploitation is straightforward once the attacker has a Subscriber level or higher account.