Q:

Does "allows to + verb" imply that the corresponding event occured?

Example:

Yahoo vulnerability allows hacker to delete 1.5 million records from database.

Does this imply that the hacker did delete those records or just that he was in the position to delete the records but not necessarily performed the action?

A:

The headline implies that the records were deleted because "allows" is its verb. If the headline were "Yahoo! Vulnerability Discovered Which Allows Hackers to Delete 1.5 Million Records From Database" it would not imply this, because it is not performing the action (it is being discovered rather than allowing access).
EDIT: I should note that another reason the headline implies the records were deleted is that it says the vulnerability allowed a hacker to delete 1.5 million records. By specifying one hacker out from the collective of hackers, it implies that he is in some way distinguished from the rest, in this case because he (may have) deleted Yahoo's records. Unless Yahoo only has 1.5 million records, those are also distinguished from the others by virtue of their being deleted.

