Ultimate WordPress Auction Plugin Missing Authorization Vulnerability Allowing Arbitrary Post Deletion

A vulnerability exists in the Ultimate WordPress Auction Plugin for WordPress, in all versions through 4.2.9. The issue allows authenticated attackers with Contributor-level access or higher to delete arbitrary auctions, posts, and pages. Additionally, it enables the execution of other auction-related actions. This vulnerability arises from improper input validation and a lack of necessary authorization checks before performing deletion actions.

Impact

Exploitation of this vulnerability could lead to unauthorized deletion of auctions and associated content, such as posts and pages. It also allows for the removal of auction-related data, potentially disrupting ongoing auction processes or causing loss of important information.

Reproduction

To reproduce this vulnerability, an authenticated user with Contributor-level access or higher can send a request to the WordPress site that includes the ID of the auction or post to be deleted. The request must bypass the nonce verification and authorization checks that are typically in place to prevent such actions.

Remediation

Users are advised to update the Ultimate WordPress Auction Plugin to version 4.3.0 or later, where this vulnerability has been addressed.