WordPress DX Delete Attached Media Plugin Broken Access Control Vulnerability

A missing authorization vulnerability has been identified in the WordPress DX Delete Attached Media plugin, specifically in versions through 2.0.5.1. This vulnerability allows unprivileged users to perform actions that require higher privileges, due to incorrectly configured access control security levels.

Impact

Exploitation of this vulnerability could lead to unauthorized users being able to delete media attachments, bypassing normal access controls.

Remediation

Users of the WordPress DX Delete Attached Media plugin should update to version 2.0.6 or later. Patchstack users can enable auto-update for vulnerable plugins.