The odude Crypto Tool WordPress plugin versions up to 2.22 register an unauthenticated AJAX action (wp_ajax_nopriv_crypto_connect_ajax_process) that permits calling the crypto_delete_json method without proper authorization. The nonce check used is publicly available and insufficient to prevent unauthorized access. As a result, attackers can delete JSON files matching the pattern *_pending.json in the wp-content/uploads/yak/ directory, leading to denial of service and data loss affecting plugin functionality.

The vulnerability allows unauthenticated attackers to delete specific JSON files critical to the plugin's operation, causing data loss and denial of service for workflows relying on these files. There is no direct confidentiality or availability impact beyond the deletion of these files. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch or official fix is available, restrict access to the wp-content/uploads/yak/ directory and monitor for suspicious AJAX requests targeting the wp_ajax_nopriv_crypto_connect_ajax_process action. Avoid using affected plugin versions in sensitive environments.