This vulnerability in WP Bulk Delete arises from missing authorization checks, allowing users with limited privileges to exploit incorrectly configured access control mechanisms. It affects versions up to 1.3.6 of the plugin. The CVSS 3.1 vector indicates network attack vector, low attack complexity, requiring low privileges, no user interaction, unchanged scope, and limited confidentiality impact.

The vulnerability could allow an attacker with low privileges to perform unauthorized actions within the WP Bulk Delete plugin, potentially leading to limited information disclosure. There is no impact on data integrity or availability according to the CVSS metrics. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to users with trusted privileges and monitor for unusual activity related to the plugin.