The YITH WooCommerce Popup plugin prior to version 1.60.0 performs a delete post meta operation without validating the requesting user’s capability. Consequently, any user who holds at least the Contributor role—or any higher role—can delete arbitrary metadata from any post on the site. This flaw permits malicious contributors to remove critical metadata that belongs to content owned by administrators or authors, potentially breaking the site’s functionality and causing loss of important configuration or product data.

The vulnerability applies to installations of the YITH WooCommerce Popup WordPress plugin older than 1.60.0. Any WordPress site running this plugin without an updated version is affected; specific CPE strings were not provided, but the product name and affected version range are sufficient to identify the risk.

An attacker must first be authenticated with Contributor privileges or higher, so the flaw is not remotely exploitable by unauthenticated users. The EPSS score is reported as less than 1 % and the vulnerability is not listed in the CISA KEV catalog, indicating a low probability of widespread exploitation. Nevertheless, sites that grant Contributor access without tight oversight face a risk of data loss or site instability, as arbitrary deletion of post metadata can disrupt product displays, pricing, and other critical functions. The lack of a CVSS score in the data suggests that the impact depends largely on the specific metadata deleted, but any loss can be severe for affected users.