WooMail WooCommerce Email Customizer Missing Authorization Vulnerability Allowing SQL Injection

A vulnerability exists in the WooMail - WooCommerce Email Customizer plugin for WordPress, in all versions through 3.0.34. The issue arises from a lack of proper capability checks in the 'template_delete_saved' function, allowing authenticated attackers with Subscriber-level access or higher to inject SQL into a post deletion query, potentially leading to unauthorized data manipulation.

Impact

Exploitation of this vulnerability could result in unauthorized SQL injection, allowing attackers to manipulate database queries and potentially access or modify sensitive data.