CVE-2026-2284 is a missing authorization vulnerability (CWE-862) in the News Element Elementor Blog Magazine WordPress plugin, affecting all versions up to 1.0.8. The issue arises from the lack of capability checks and nonce verification on the 'ne_clean_data' AJAX action. Authenticated attackers with Subscriber-level privileges or higher can exploit this to truncate eight critical WordPress database tables (posts, comments, terms, term_relationships, term_taxonomy, postmeta, commentmeta, termmeta) and delete the entire uploads directory, causing extensive data loss. The vulnerability has a CVSS 3.1 score of 5.4, reflecting a medium severity with network attack vector, low attack complexity, and no user interaction required.

Exploitation of this vulnerability allows authenticated users with minimal privileges (Subscriber or above) to cause significant data loss by truncating core WordPress database tables and deleting all uploaded media files. This results in loss of content, metadata, and media assets, potentially disrupting website functionality and requiring full restoration from backups.

No official patch or remediation guidance is currently available from the vendor. Users should monitor the vendor's advisory channels for updates. Until a fix is released, restrict Subscriber-level user capabilities where possible and consider disabling or removing the vulnerable plugin to prevent exploitation.