{"id":"CVE-2026-118065","kind":"vulnerability","aliases":["CVE-2026-118065"],"related":[],"title":"Advance Guest Post WordPress plugin lets anyone delete Media Library files","description":"The Advance Guest Post WordPress plugin through 1.9 does not perform any authorization or ownership check when deleting media attachments, relying only on a nonce exposed to every site visitor, allowing unauthenticated users to permanently delete arbitrary Media Library attachments and their files.","summary":"The Advance Guest Post WordPress plugin through version 1.9 does not check who is asking before deleting media attachments. A nonce that every site visitor can see is the only gate, so an unauthenticated user can permanently delete any Media Library attachment and its files.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Advance Guest Post","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"Advance Guest Post","fixed":[],"affected":"<= 1.9","ecosystem":"wordpress-plugin"}],"ecosystems":["vendor"],"tags":["advance-guest-post","auth-not-required","package","wordpress","wordpress-plugin"],"not_affected_if":["plugin-above-1.9","plugin-not-installed"],"how_to_check":"Run 'wp plugin list' or open Plugins in wp-admin and look for 'Advance Guest Post' (slug advance-guest-post) at any version; 1.9 is the only release and every version up to it is affected. Also check that the Media Library has not lost files unexpectedly.","fix":"No fixed version: WordPress.org closed the plugin on 2026-10-28 (temporary, pending review) and the last release is 1.9. Remove the plugin.","status":"open","published_at":"2026-11-13T06:16:52+00:00","first_seen_at":"2026-11-13T06:42:16+00:00","triaged_at":"2026-11-13T06:42:35+00:00","updated_at":"2026-11-13T06:45:32+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-13T06:42:35Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Advance Guest Post WordPress plugin lets anyone delete Media Library files","impact":"medium","summary":"The Advance Guest Post WordPress plugin through version 1.9 does not check who is asking before deleting media attachments. A nonce that every site visitor can see is the only gate, so an unauthenticated user can permanently delete any Media Library attachment and its files.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugin","advance-guest-post"],"confidence":0.7,"fix_status":"unknown","needs_auth":"no","worst_case":"unauthenticated attackers permanently delete Media Library files","analyst_note":"Confirm the fixed version and whether a patch exists at https://nvd.nist.gov/vuln/detail/CVE-2026-118065 or the plugin's WordPress.org page.","how_to_check":"- Check whether the `Advance Guest Post` plugin is installed and at version `1.9` or earlier in the WordPress plugins screen or `wp plugin list`\n- unknown","plain_action":"","product_name":"Advance Guest Post","needs_analyst":true,"not_affected_if":["plugin-not-installed","plugin-above-1.9"],"who_is_affected":"Sites running the Advance Guest Post plugin at version 1.9 or earlier are exposed, because the delete action trusts a nonce visible to every visitor. Sites that do not use this plugin are not affected. The sources do not say which versions are fixed or whether the vendor has released a patch.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000753,"input_tokens":4539,"output_tokens":598,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Confirm the fixed version and whether a patch exists at https://nvd.nist.gov/vuln/detail/CVE-2026-118065 or the plugin's WordPress.org page.","search":"'-118065':14A,17A '-2026':13A,16A '1.9':45B,89C 'advanc':1A,25B,38B,83C 'advance':18A,21A 'advance-guest-post':24B 'allow':112C 'anyon':7A 'arbitrari':118C 'ask':51B 'attach':55B,78B,101C,121C 'auth':29B 'auth-not-requir':28B 'author':94C 'check':48B,97C 'cve':12A,15A 'delet':8A,53B,74B,99C,117C 'everi':59B,109C 'expos':107C 'file':11A,81B,124C 'gate':67B 'guest':2A,19A,22A,26B,39B,84C 'let':6A 'librari':10A,77B,120C 'media':9A,54B,76B,100C,119C 'nonc':57B,106C 'ownership':96C 'packag':32B 'perform':92C 'perman':73B,116C 'plugin':5A,36B,42B,87C 'post':3A,20A,23A,27B,40B,85C 'reli':102C 'requir':31B 'see':63B 'site':60B,110C 'unauthent':70B,113C 'user':71B,114C 'version':44B 'visitor':61B,111C 'wordpress':4A,33B,35B,41B,86C 'wordpress-plugin':34B","nicknames":[],"mitigations":[],"who_affected":"Any WordPress site with the Advance Guest Post plugin (version 1.9 or earlier) installed and active. The delete action is gated only by a nonce shown to every visitor, so anyone can remove Media Library attachments and their files. Sites without the plugin can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-13T06:45:32Z","by":"analyst","doc":"https://wordpress.org/plugins/advance-guest-post/","run_id":3828}},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["advanceguestpost","guestpost"],"ptokens":["advance","guest","post"],"labels":["advanceguestpost","authnotrequired","high","package","vendor","wordpress","wordpressplugin"],"campaign_type":null,"search_a":"'-118065':14A,17A '-2026':13A,16A 'advanc':1A 'advance':18A,21A 'anyon':7A 'cve':12A,15A 'delet':8A 'file':11A 'guest':2A,19A,22A 'let':6A 'librari':10A 'media':9A 'plugin':5A 'post':3A,20A,23A 'wordpress':4A","search_b":"'1.9':45B 'advanc':25B,38B 'advance-guest-post':24B 'ask':51B 'attach':55B,78B 'auth':29B 'auth-not-requir':28B 'check':48B 'delet':53B,74B 'everi':59B 'file':81B 'gate':67B 'guest':26B,39B 'librari':77B 'media':54B,76B 'nonc':57B 'packag':32B 'perman':73B 'plugin':36B,42B 'post':27B,40B 'requir':31B 'see':63B 'site':60B 'unauthent':70B 'user':71B 'version':44B 'visitor':61B 'wordpress':33B,35B,41B 'wordpress-plugin':34B","search_c":"'1.9':89C 'advanc':83C 'allow':112C 'arbitrari':118C 'attach':101C,121C 'author':94C 'check':97C 'delet':99C,117C 'everi':109C 'expos':107C 'file':124C 'guest':84C 'librari':120C 'media':100C,119C 'nonc':106C 'ownership':96C 'perform':92C 'perman':116C 'plugin':87C 'post':85C 'reli':102C 'site':110C 'unauthent':113C 'user':114C 'visitor':111C 'wordpress':86C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T06:16:52+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118065","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118065","severity":null,"published_at":"2026-11-13T06:16:52+00:00","modified_at":"2026-11-13T06:16:52+00:00","first_seen_at":"2026-11-13T06:42:16+00:00","fetched_at":"2026-11-13T06:42:16+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-118065:3828","url":"https://wordpress.org/plugins/advance-guest-post/","severity":null,"published_at":"2026-11-13T06:45:32+00:00","modified_at":"2026-11-13T06:45:32+00:00","first_seen_at":"2026-11-13T06:45:32+00:00","fetched_at":"2026-11-13T06:45:32+00:00","note":"CVE text (via HOL/WPScan mirror) says no authorization check, nonce exposed to visitors. WordPress.org page shows plugin closed 2026-10-28, no fix. NVD/WPScan pages unreadable; no PoC or exploitation found; X not checked.","cites":["https://wordpress.org/plugins/advance-guest-post/","https://hol.org/guard/security/cves/CVE-2026-118065-advance-guest-post-19-unauthenticated-arbitrary"]}],"documents":[{"id":143474,"url":"https://wordpress.org/plugins/advance-guest-post/","title":"advance-guest-post plugin page (closed)","kind":"vendor","source":"analyst","publisher":null,"text":"Plugin closed as of October 28, 2026, not available for download; closure temporary pending full review. Version 1.9, last updated 12 years ago.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":143481,"url":"https://hol.org/guard/security/cves/CVE-2026-118065-advance-guest-post-19-unauthenticated-arbitrary","title":"HOL Guard record CVE-2026-118065 (quotes CVE description, cites WPScan)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}