The Database Cleaner plugin for WordPress versions up to and including 1.4.7 has a vulnerability that allows authenticated users with Administrator-level access or higher to delete arbitrary database tables. This occurs because the plugin does not restrict which database tables can be deleted, potentially enabling deletion of core WordPress tables.