AdForest WordPress Theme Missing Authorization Vulnerability Allowing Arbitrary Post Deletion

A vulnerability exists in the AdForest theme for WordPress, all versions through 5.1.7, due to a lack of proper capability checks on several AJAX actions, including 'sb_remove_ad'. This flaw enables authenticated attackers with Subscriber-level access and above to delete posts and attachments, as well as deactivate a license.

Impact

Exploitation of this vulnerability allows for unauthorized deletion of posts and attachments by authenticated users with Subscriber-level access or higher. Additionally, it enables the deactivation of licenses.

Remediation

Users can update to AdForest version 5.1.8 or a newer patched version to address this vulnerability.