The WP EasyPay plugin for WordPress allows an attacker with subscriber-level access to delete arbitrary content. This vulnerability enables removal of posts, pages or other content, compromising data integrity and availability. It reflects a flaw in access control mechanisms, classified as CWE-862.

The issue affects the WordPress WP EasyPay plugin developed by Saad Iqbal. All releases version 4.5.0 and earlier are vulnerable.

The CVSS score of 6.5 indicates a moderate impact. The EPSS score of less than 1% suggests a low probability of exploitation, and the vulnerability is not currently listed in the CISA KEV catalog. The attack likely requires a valid subscriber account or local access to the site, so an attacker would need to authenticate. Once authenticated, the attacker can invoke the deletion action and remove content without authorization.