The Trash Duplicate and 301 Redirect WordPress plugin suffers from a missing capability check (CWE-862) on the 'duplicates-action-top' action. This authorization bypass enables unauthenticated users to perform deletion of arbitrary posts or pages, leading to unauthorized data loss. The vulnerability affects all plugin versions up to 1.9. The CVSS 3.1 base score is 7.5, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact. No patch or remediation details are currently provided by the vendor.

An unauthenticated attacker can delete arbitrary posts or pages on a WordPress site using the vulnerable plugin, resulting in unauthorized data loss and potential content disruption. There is no confidentiality or availability impact reported. The integrity of site content is severely affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider disabling or removing the vulnerable plugin to prevent exploitation. Monitor official solwininfotech communications for updates on patches or mitigations.