The Pearl – Header Builder plugin for WordPress contains a missing authorization vulnerability (CWE-862) in the stm_hb_delete() function. This flaw allows unauthenticated attackers to delete arbitrary site options due to lack of validation and capability checks. Exploitation can result in denial of service by disrupting site configuration. The issue affects all versions up to 1.3.7. The CVSS 3.1 score is 6.5 (medium severity), with attack vector network, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, limited integrity impact, and high availability impact. No patch or vendor advisory is currently available, and no known exploits have been reported.

An unauthenticated attacker can delete arbitrary site options in the affected WordPress plugin, potentially causing denial of service by disrupting site functionality. There is no confidentiality impact, but integrity is partially affected and availability can be significantly impacted. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider disabling or removing the Pearl – Header Builder plugin if feasible to prevent exploitation. Monitor for vendor updates or security advisories regarding this vulnerability.