CVE-2021-25116: Enqueue Anything Project Enqueue Anything

Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days.

The Enqueue Anything WordPress plugin through 1.0.1 does not have authorisation and CSRF checks in the remove_asset AJAX action, and does not ensure that the item to be deleted is actually an asset. As a result, low privilege users such as subscriber could delete arbitrary assets, as well as put arbitrary posts in the trash.

Affected products

• Enqueue Anything Project Enqueue Anything: up to and including 1.0.1

Published 2022-06-13. Last modified 2026-06-17.