{"affected":[{"defaultStatus":"unknown","product":"Advance Guest Post","source":"CNA: WPScan","vendor":"Unknown","versions":[{"lessThanOrEqual":"1.9","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-118065","cwes":["CWE-862"],"description":"The Advance Guest Post WordPress plugin through 1.9 does not perform any authorization or ownership check when deleting media attachments, relying only on a nonce exposed to every site visitor, allowing unauthenticated users to permanently delete arbitrary Media Library attachments and their files.","epss":null,"exploits":[{"kind":"exploit","source":"CNA: WPScan","url":"https://wpscan.com/vulnerability/77771b0e-a3e7-4dd6-b5b4-c179c6db1deb/"}],"kev":null,"metrics":[],"modifiedAt":1794549607303,"publishedAt":1794549607303,"references":[{"source":"CNA: WPScan","tags":["exploit","vdb-entry","technical-description"],"url":"https://wpscan.com/vulnerability/77771b0e-a3e7-4dd6-b5b4-c179c6db1deb/"}],"remediation":[],"revision":"1f320143e068b34179f8163396bc8aa4dd9901c59fd575cc044b62aa17059743","sources":[{"modifiedAt":1794549607303,"name":"CNA: WPScan","retrievedAt":1794550128716,"url":"https://www.cve.org/CVERecord?id=CVE-2026-118065"}],"ssvc":null,"status":"published","title":"Advance Guest Post <= 1.9 - Unauthenticated Arbitrary Attachment Deletion","updatedAt":1794550128716}