CyberRota Analysis
AI-GeneratedThe Portfolio Filter Gallery plugin for WordPress versions prior to 2.2.1 is vulnerable due to a lack of per-object authorization checks, enabling users with Contributor roles and higher to delete media attachments belonging to other users, including administrators. This flaw poses a significant risk of unauthorized data loss and could compromise the integrity of media management within affected WordPress sites. WordPress site administrators and security teams should prioritize updating this plugin to mitigate potential abuse.
Original NVD Description
The Portfolio Filter Gallery WordPress plugin before 2.2.1 does not perform a per-object authorization check before deleting an attachment, allowing users with the Contributor role and above to permanently delete certain media attachments belonging to other users, including administrators.