# Culture Object <= 4.3 - Unauthenticated Missing Authorization to Imported Object Deletion via Debug Purge

- **ID:** WPSEC-2026-0882
- **Plugin:** Culture Object (`culture-object`), https://wordpress.org/plugins/culture-object/
- **Affected versions:** all versions before 4.4
- **Fixed in:** 4.4 (Update to 4.4 or later.)
- **Severity:** Medium 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-10-14)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/culture-object
- **Fix released:** 2026-10-13
- **Published:** 2026-10-14
- **URL:** https://wpsec.com/vuln/WPSEC-2026-0882/

## Description

The Culture Object plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check and missing nonce validation on the purge_objects() function in all versions up to, and including, 4.3. The function runs on the 'init' hook and only checks is_admin() and the 'perform_cos_debug_purge' GET parameter. is_admin() is also true for logged-out requests to wp-admin/admin-ajax.php. This makes it possible for unauthenticated attackers to permanently delete all imported culture objects on the site.

## References

- https://wpsec.com/vuln/WPSEC-2026-0882/
- https://plugins.svn.wordpress.org/culture-object/tags/4.4/
- https://wordpress.org/plugins/culture-object/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-0882/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.