CVE-2026-118065: Advance Guest Post <= 1.9 - Unauthenticated Arbitrary Attachment Deletion

Q: Who can exploit this issue?

Any site visitor can exploit it without authentication, because the deletion action relies on a nonce exposed to every visitor and does not verify authorization or attachment ownership.

Q: What can an attacker delete?

An attacker can permanently delete arbitrary attachments in the WordPress Media Library, including their associated files.

Q: Which plugin versions are affected?

Advance Guest Post versions through 1.9 are affected.

Published Nov 13, 2026

Updated

The Advance Guest Post WordPress plugin through 1.9 does not perform any authorization or ownership check when deleting media attachments, relying only on a nonce exposed to every site visitor, allowing unauthenticated users to permanently delete arbitrary Media Library attachments and their files.

Event History

Nov 13, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·06:16 AM

Description

Frequently Asked Questions

Who can exploit this issue?

Any site visitor can exploit it without authentication, because the deletion action relies on a nonce exposed to every visitor and does not verify authorization or attachment ownership.

What can an attacker delete?

An attacker can permanently delete arbitrary attachments in the WordPress Media Library, including their associated files.

Which plugin versions are affected?

Advance Guest Post versions through 1.9 are affected.