CVE-2026-6802 is an authorization bypass vulnerability in the Easy Upload Files During Checkout plugin for WordPress, affecting all versions up to and including 3.0.1. The vulnerability is due to the lack of proper authorization checks in the ufdc_custom_init() function. Specifically, the function processes the 'eufdc-delete' parameter without verifying a nonce, checking user capabilities, or validating attachment ownership. As a result, unauthenticated attackers can exploit this flaw to delete arbitrary media library attachments on the affected WordPress site.

The vulnerability allows unauthenticated attackers to permanently delete arbitrary media library attachments from the WordPress site. This leads to integrity loss of media content but does not impact confidentiality or availability directly. The CVSS score of 5.3 reflects a medium severity impact primarily on integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the plugin's functionality and monitor for suspicious deletion activity. Avoid using the plugin in environments where unauthorized media deletion would cause significant impact.