The Projectopia WordPress plugin suffers from a missing capability check on the pto_delete_file AJAX action in all versions up to 5.1.19. This lack of authorization verification enables unauthenticated attackers to delete arbitrary attachments within the system. The vulnerability is classified under CWE-862 (Missing Authorization). The CVSS 3.1 base score is 5.3, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality or availability impact, but low integrity impact.

An attacker without authentication can delete arbitrary attachments in the Projectopia plugin, leading to unauthorized modification of data. There is no impact on confidentiality or availability. The integrity of stored attachments is compromised, which may disrupt project management workflows or cause data loss.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting access to the affected AJAX action or disabling the plugin if feasible. Monitor for vendor updates and apply patches promptly once released.