The WPBot AI ChatBot plugin for WordPress suffers from improper access control (CWE-284) in the openai_file_delete_callback function. This function lacks a capability check, enabling authenticated users with low-level privileges (subscriber and above) to delete files associated with the linked OpenAI account. This vulnerability affects all versions up to and including 5.3.4. The CVSS 3.1 base score is 5.0 (medium), reflecting network attack vector, low attack complexity, privileges required, no user interaction, scope changed, no confidentiality impact, limited integrity impact, and no availability impact.

An attacker with subscriber-level access can delete files from the linked OpenAI account, resulting in unauthorized modification of data. There is no impact on confidentiality or availability. The scope is changed, indicating the vulnerability affects resources beyond the original security scope of the plugin. No known exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict subscriber-level access to trusted users only and monitor for suspicious activity related to file deletions in the OpenAI account linked to the plugin.