Executive brief
The Delete All Posts plugin for WordPress, which is used to bulk-remove content from a website, contains a security flaw that allows unauthorized individuals to delete posts. An attacker could exploit this to wipe out a site's content, leading to significant data loss and operational disruption. There is currently no official patch available from the developer to fix this issue.
Technical details
A Missing Authorization (CWE-862) vulnerability exists in the mingocommerce Delete All Posts plugin through version 1.1.1. The plugin fails to implement proper access control checks or nonce validation on its post-deletion functionality. This allows an unauthenticated remote attacker to trigger the deletion of all posts on the WordPress site via a direct network request. As of the latest advisory, no official patch has been released by the vendor, and users are advised to seek alternative mitigation strategies such as web application firewalls.
Affected products
- mingocommerce Delete All Posts through 1.1.1
Timeline
- 2024-11-28: other: Vulnerability reported by researcher Mika
- 2025-01-16: advisory: Patchstack published initial advisory
- 2025-04-17: disclosed: CVE published to NVD