The Fluent Forms Pro Add On Pack plugin for WordPress contains a missing authorization vulnerability (CWE-862) in its deleteFile() method within the Uploader class. The AJAX action handling file deletion is registered via addPublicAjaxAction(), which creates hooks accessible to unauthenticated users (wp_ajax_nopriv_). Because the method lacks nonce verification and capability checks, attackers can delete arbitrary media attachments by providing the attachment_id parameter. Although initial reports suggested exploitation via a path parameter, the actual code uses a decryption method that prevents this attack vector. This vulnerability affects all versions up to and including 6.1.17.

An unauthenticated attacker can delete arbitrary WordPress media attachments, leading to potential loss of media content and disruption of website functionality. There is no confidentiality impact, but integrity and availability are affected due to unauthorized deletion of media files. The CVSS score of 6.5 reflects a medium severity with network attack vector, no privileges required, and no user interaction needed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix links are provided, users should monitor the vendor's announcements for updates. Until a fix is available, restricting access to AJAX endpoints or disabling the vulnerable add-on may reduce risk. Avoid exposing the vulnerable plugin on publicly accessible sites without additional access controls.