---
id: "CVE-2026-118065"
page: "https://infrastack.ai/live/CVE-2026-118065"
kind: "vulnerability"
aliases: ["CVE-2026-118065"]
title: "Advance Guest Post WordPress plugin lets anyone delete Media Library files"
severity: "high"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "Advance Guest Post", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "Advance Guest Post", "fixed": [], "affected": "<= 1.9", "ecosystem": "wordpress-plugin"}]
ecosystems: ["vendor"]
tags: ["advance-guest-post", "auth-not-required", "package", "wordpress", "wordpress-plugin"]
not_affected_if: ["plugin-above-1.9", "plugin-not-installed"]
published_at: "2026-11-13T06:16:52+00:00"
first_seen_at: "2026-11-13T06:42:16+00:00"
updated_at: "2026-11-13T06:45:32+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118065", "first_seen_at": "2026-11-13T06:42:16+00:00"}, {"source": "analyst", "url": "https://wordpress.org/plugins/advance-guest-post/", "first_seen_at": "2026-11-13T06:45:32+00:00", "cites": ["https://wordpress.org/plugins/advance-guest-post/", "https://hol.org/guard/security/cves/CVE-2026-118065-advance-guest-post-19-unauthenticated-arbitrary"]}]
exploit_sources: []
---

# Advance Guest Post WordPress plugin lets anyone delete Media Library files

Link for people: https://infrastack.ai/live/CVE-2026-118065 (this .md is for agents)

The Advance Guest Post WordPress plugin through version 1.9 does not check who is asking before deleting media attachments. A nonce that every site visitor can see is the only gate, so an unauthenticated user can permanently delete any Media Library attachment and its files.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Advance Guest Post affected range not listed fixed no fixed version listed
- wordpress-plugin:Advance Guest Post affected <= 1.9 fixed no fixed version listed

## How to check

Run 'wp plugin list' or open Plugins in wp-admin and look for 'Advance Guest Post' (slug advance-guest-post) at any version; 1.9 is the only release and every version up to it is affected. Also check that the Media Library has not lost files unexpectedly.

## Fix

No fixed version: WordPress.org closed the plugin on 2026-10-28 (temporary, pending review) and the last release is 1.9. Remove the plugin.

## Timeline

- 2026-11-13T06:42:16+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118065
- 2026-11-13T06:45:32+00:00 analyst https://wordpress.org/plugins/advance-guest-post/ — CVE text (via HOL/WPScan mirror) says no authorization check, nonce exposed to visitors. WordPress.org page shows plugin closed 2026-10-28, no fix. NVD/WPScan pages unreadable; no PoC or exploitation found; X not checked.

## Documents

- [advisory] advance-guest-post plugin page (closed) https://wordpress.org/plugins/advance-guest-post/
- [describes] HOL Guard record CVE-2026-118065 (quotes CVE description, cites WPScan) https://hol.org/guard/security/cves/CVE-2026-118065-advance-guest-post-19-unauthenticated-arbitrary

## From the sources

The Advance Guest Post WordPress plugin through 1.9 does not perform any authorization or ownership check when deleting media attachments, relying only on a nonce exposed to every site visitor, allowing unauthenticated users to permanently delete arbitrary Media Library attachments and their files.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_