Comment by joe_hills

Some sites have plugins that allow users to create accounts with minimal permissions.

An attacker could create such an account, then abuse a legitimate nonce to delete files.