The vulnerability identified as CVE-2025-58192 affects the WP Bulk Delete plugin for WordPress developed by Xylus Themes. It is a missing authorization issue where the plugin fails to enforce correct access control, potentially allowing users with limited privileges to perform unauthorized actions. The affected versions include all releases up to 1.3.6. The CVSS 3.1 base score is 4.3, reflecting a network attack vector with low complexity and requiring low privileges, no user interaction, and impacts confidentiality only. There is no indication of an official patch or vendor advisory at this time.

The impact is limited to unauthorized access to certain plugin functions, potentially leading to limited confidentiality loss. There is no reported impact on integrity or availability. Since the vulnerability requires low privileges and network access, an attacker with some level of access could exploit it to bypass intended access controls within the plugin's functionality. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the WP Bulk Delete plugin to trusted users only and monitor for unusual activity related to bulk deletion operations. Avoid granting unnecessary privileges to users who can access this plugin's features.