The Social Auto Poster plugin for WordPress suffers from a missing capability check in the 'wpw_auto_poster_quick_delete_multiple' function in all versions up to and including 5.3.14. This missing authorization allows unauthenticated attackers to delete arbitrary posts, resulting in unauthorized modification and potential data loss. The vulnerability is classified under CWE-862 (Missing Authorization). The CVSS v3.1 base score is 6.5, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, but low integrity and high availability impact.

An attacker without authentication can delete arbitrary posts on a WordPress site using the vulnerable Social Auto Poster plugin. This leads to loss of data integrity and availability but does not affect confidentiality. The impact is limited to content deletion and disruption of site functionality related to posts managed by the plugin.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the plugin's functionality and monitor for suspicious activity related to post deletions. Avoid using vulnerable versions of the plugin in publicly accessible environments.