CVE-2022-4102 — Royal Elementor Addons < 1.3.56 - Subscriber+ Arbitrary Post Deletion
The Royal Elementor Addons WordPress plugin before 1.3.56 does not have authorization and CSRF checks when deleting a template and does not ensure that the post to be deleted is…
Published: 2023-01-09 · CVSS: 3.1 · CVSS 3.1
The Royal Elementor Addons WordPress plugin before 1.3.56 does not have authorization and CSRF checks when deleting a template and does not ensure that the post to be deleted is a template. This could allow any authenticated users, such as subscribers, to delete arbitrary posts assuming they know the related slug.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7