CVE-2024-6755 is a vulnerability identified in the WPWeb Social Auto Poster plugin for WordPress, present in all versions up to and including 5.3.14. The core issue is a missing capability check (authorization) in the function 'wpw_auto_poster_quick_delete_multiple', which is responsible for deleting multiple posts quickly. Due to this missing authorization, unauthenticated attackers can invoke this function remotely without any privileges, enabling them to delete arbitrary posts from the affected WordPress sites. The vulnerability is classified under CWE-862 (Missing Authorization) and has a CVSS v3.1 base score of 6.5, indicating a medium severity level. The attack vector is network-based (AV:N), requires no privileges (PR:N), and no user interaction (UI:N), making it relatively easy to exploit. The impact affects integrity and availability by allowing unauthorized deletion of content, but confidentiality is not impacted. No patches or official fixes are currently linked, and no known exploits have been reported in the wild as of the publication date. However, the potential for data loss and disruption to website operations is significant, especially for sites relying heavily on the Social Auto Poster plugin for content management and social media automation.

The vulnerability allows unauthenticated attackers to delete arbitrary posts on affected WordPress sites, leading to potential data loss and disruption of website content integrity and availability. This can damage the reputation of organizations, cause operational downtime, and require costly recovery efforts. For businesses relying on WordPress for content delivery and marketing automation, such unauthorized deletions can interrupt workflows and social media campaigns. The ease of exploitation (no authentication or user interaction required) increases the risk of automated attacks or mass exploitation attempts. While confidentiality is not directly impacted, the loss of data and service availability can have significant indirect consequences, including loss of customer trust and potential financial losses. Organizations with large or high-traffic WordPress sites are particularly vulnerable to reputational damage and operational impact.

1. Immediate mitigation involves disabling or uninstalling the Social Auto Poster plugin until a security patch is released. 2. Monitor WordPress logs and web server access logs for suspicious POST requests targeting the 'wpw_auto_poster_quick_delete_multiple' function or related endpoints. 3. Implement Web Application Firewall (WAF) rules to block unauthorized access to plugin-specific AJAX or admin endpoints, especially those related to post deletion. 4. Restrict access to WordPress admin-ajax.php and other plugin endpoints by IP whitelisting or authentication where feasible. 5. Regularly back up WordPress content and database to enable quick restoration in case of unauthorized deletions. 6. Follow WPWeb and WordPress security advisories closely for official patches or updates and apply them promptly. 7. Consider employing security plugins that enforce capability checks and monitor unauthorized changes to posts. 8. Educate site administrators about the risks of installing plugins without proper security reviews and encourage minimal plugin usage.