The Comment Images Reloaded plugin for WordPress suffers from a missing capability check (CWE-862) on the cir_delete_image AJAX action in all versions up to 2.2.1. This authorization bypass enables authenticated users with low privileges (Subscriber and above) to delete arbitrary media attachments, leading to potential loss of availability of media content. The vulnerability has a CVSS 3.1 base score of 4.3 (medium severity), reflecting network attack vector, low attack complexity, and low privileges required. No patch or official fix information is currently available.

An attacker with authenticated Subscriber-level access or higher can delete arbitrary media attachments via the vulnerable AJAX action. This results in availability loss of media files managed by the plugin. There is no impact on confidentiality or integrity according to the CVSS vector. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user roles and permissions to trusted users only and monitor for suspicious activity related to media deletion. Avoid granting Subscriber-level access to untrusted users.