CVE-2026-118065

Not scored yetLast modified Nov 13, 2026

Description

The Advance Guest Post WordPress plugin through 1.9 does not perform any authorization or ownership check when deleting media attachments, relying only on a nonce exposed to every site visitor, allowing unauthenticated users to permanently delete arbitrary Media Library attachments and their files.

Metrics

No CVSS score has been published yet.

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
Unknown	Advance Guest Post	<= 1.9

References

https://wpscan.com/vulnerability/77771b0e-a3e7-4dd6-b5b4-c179c6db1deb/

Timeline

Published: Nov 13, 2026
Last modified: Nov 13, 2026
NVD status: Received

Related CVEs from 2026

CVE-2026-1180669.1The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Authentication Bypass CVE-2026-1180675.4The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting CVE-2026-118079.6A missing authorization vulnerability was found in the Event-Driven Ansible (EDA) websocket API. The /api/eda/ws/ansible-rulebook endpoint d CVE-2026-1180707.2The Welcart e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'gid' parameter in all versions up to, and CVE-2026-1180716.8The Joinchat WordPress plugin before 6.4.2 does not escape the message of its button block before outputting it in an HTML attribute on the CVE-2026-1180725.4The Fraud Prevention For WooCommerce and EDD WordPress plugin before 2.3.6 does not check that a user is allowed to manage orders before let CVE-2026-1180738.8Subscriber PHP Object Injection in News Kit Elementor Addons <= 1.5.0 versions.CVE-2026-1180747.2Shop manager PHP Object Injection in Finale Lite <= 2.21.0 versions.CVE-2026-1180758.8Contributor PHP Object Injection in WP Media folders <= 1.1.10 versions.CVE-2026-1180768.8Contributor PHP Object Injection in Frisbii Pay <= 1.8.19 versions.CVE-2026-1180777.2Author PHP Object Injection in Sastra Essential Addons for Elementor <= 1.2.3 versions.CVE-2026-1180787.2Shop manager PHP Object Injection in Product Catalog Feed by PixelYourSite <= 3.1.4 versions.