CVE-2024-13318 is a vulnerability in the Essential WP Real Estate plugin for WordPress caused by the absence of a capability check in the cl_delete_listing_func() function. This flaw allows unauthenticated attackers to delete arbitrary pages and posts, impacting data integrity. The vulnerability affects all versions up to and including 1.1.3. It is categorized under CWE-463, which involves improper deletion of data structure sentinels. The CVSS 3.1 base score is 5.3, reflecting a medium risk with network attack vector, low attack complexity, no privileges required, and no user interaction needed.

An attacker without authentication can delete arbitrary pages and posts on a WordPress site using the vulnerable plugin, leading to potential data loss and disruption of site content. There is no reported impact on confidentiality or availability. The vulnerability does not require user interaction or privileges, increasing the risk of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the plugin's functionality and monitor for unauthorized deletion activity. Avoid using affected versions of the plugin in production environments if possible.