The Video Gallery for WooCommerce plugin for WordPress contains a missing authorization (CWE-862) vulnerability in the remove_unused_thumbnails() function in all versions up to 1.31. This lack of capability checks enables unauthenticated attackers to delete thumbnail images stored in the video-wc-gallery-thumb directory. The CVSS 3.1 base score is 5.3 (medium), reflecting network attack vector, low complexity, no privileges required, no user interaction, and impact limited to integrity loss (unauthorized data modification). No patch or official remediation information is currently available.

An attacker without authentication can delete thumbnail images used by the plugin, causing unauthorized modification of plugin data. This may disrupt the display of video thumbnails but does not affect confidentiality or availability of the system. There are no reports of exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider restricting access to the affected directories via web server configuration or other access controls to prevent unauthorized deletion of thumbnail files.