Essential WP Real Estate Missing Authorization Vulnerability Allowing Arbitrary Post Deletion

A vulnerability exists in the Essential WP Real Estate plugin for WordPress, in all versions through 1.1.3. The issue arises from a lack of proper capability checks in the 'cl_delete_listing_func()' function, allowing unauthenticated users to delete any post or page.

Impact

Exploitation of this vulnerability allows for unauthorized deletion of posts or pages.

Reproduction

The vulnerability can be reproduced by sending a request to the 'wp_ajax_cl_delete_listing_func' action without the necessary authorization. This can be done by an unauthenticated user, as the plugin does not verify user capabilities before allowing the deletion.

Remediation

No patch is currently available. Users are advised to uninstall the affected plugin and consider using a replacement.