WordPress Finale Lite Plugin Missing Authorization Vulnerability Allowing Arbitrary Content Deletion

A missing authorization vulnerability exists in the WordPress Finale Lite plugin, specifically in versions through 2.16.0. This vulnerability allows for arbitrary content deletion, as it exploits incorrectly configured access control security levels. An unauthenticated user could potentially delete various types of content from a website, such as posts, pages, or media.

Impact

Exploitation of this vulnerability could lead to unauthorized deletion of content from the affected WordPress site, including posts, pages, or media files.

Remediation

Users of the WordPress Finale Lite plugin should update to version 2.17.0 or later. Patchstack users can enable auto-update for vulnerable plugins.