The Zip Attachments plugin for WordPress suffers from a missing authorization vulnerability (CWE-862) in the download.php script in all versions up to 1.6. This flaw permits unauthenticated attackers to delete arbitrary files located in the WordPress uploads directory (wp_upload_dir) because the plugin fails to verify user permissions before processing deletion requests. The vulnerability has a CVSS 3.1 base score of 5.3, indicating a medium severity level, with network attack vector, low attack complexity, no privileges required, and no user interaction needed. There is no indication of confidentiality or availability impact, only integrity loss due to unauthorized file deletion. No known exploits are reported in the wild, and no patch or official fix is currently documented.

An attacker can delete arbitrary files within the WordPress uploads directory without authentication, resulting in unauthorized data loss and integrity compromise. There is no impact on confidentiality or availability according to the CVSS vector and description. This could disrupt website functionality or cause loss of uploaded media or documents stored in the affected directory.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the download.php file and the uploads directory through web server configuration or other access controls to prevent unauthorized deletion. Monitoring for unusual file deletions and limiting plugin usage may also reduce risk.