This vulnerability arises because the Redux Framework plugin does not verify that a user has permission before deleting an attachment. An attacker who has a subscriber or higher role can use the 'attachment_id' parameter in an HTTP request to remove any file stored in the media library, including files owned by administrators. The weakness is an Access Control Failure (CWE-862) that lets the attacker delete content, potentially causing data loss or service disruption.

The Redux Framework plugin, developed by davidanderson, is installed in many WordPress sites. Versions up to and including 4.5.14 are affected. Sites that expose a Custom Fonts field on the user profile page via Redux_Users::set_profile() are vulnerable, because that rendering process includes a nonce required for the deletion action.

The CVSS score of 4.3 indicates moderate severity. EPSS is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting no widespread exploitation yet. The exploit requires an authenticated user with subscriber‑level privileges and access to the site’s admin profile page. Once the Custom Fonts field is registered, the required nonce is rendered, enabling the malicious user to craft a request that deletes any attachment. Because the required preconditions are commonly met on many WordPress installations, the risk to affected sites is significant for users who rely on media attachments for critical content.