CVE-2023-5454 — Templately < 2.2.6 - Arbitrary post trashing via Missing Authorization
The Templately WordPress plugin before 2.2.6 does not properly authorize the `saved-templates/delete` REST API call, allowing unauthenticated users to delete arbitrary posts.
Published: 2023-11-06 · CVSS: 7.5 · CVSS 3.1
The Templately WordPress plugin before 2.2.6 does not properly authorize the `saved-templates/delete` REST API call, allowing unauthenticated users to delete arbitrary posts.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7