The Taqnix WordPress plugin is vulnerable to a cross‑site request forgery flaw that allows an unauthenticated attacker to cause a logged‑in non‑administrator user to delete their own account. The vulnerability results from a missing nonce validation in the taqnix_delete_my_account() function, where the standard check_ajax_referer() call has been commented out. Because the action accepts a forged request, any page or link that an attacker can trick the user into visiting could trigger the deletion without the user’s knowledge.

WordPress sites that have the Taqnix plugin installed in any version up to and including 1.0.3 are affected. The issue resides in the server‑side AJAX endpoint taqnix_delete_my_account provided by the plugin.

The flaw carries a CVSS score of 4.3, indicating a moderate severity and limited impact beyond the loss of the targeted account. The EPSS score of less than 1% suggests that exploitation in the wild is unlikely, and the vulnerability is not listed in the CISA KEV catalog. Attackers would still need to co‑ordinate a social‑engineering scenario to lure a user to a malicious request; no remote code execution or privilege escalation result from this vulnerability.