Phrase TMS Integration for WordPress Missing Authorization Vulnerability in Log Deletion

A vulnerability exists in the Phrase TMS Integration for WordPress plugin, affecting all versions through 4.7.5. The issue arises from a lack of proper capability checks on the 'wp_ajax_delete_log' AJAX endpoint, allowing authenticated attackers with Subscriber-level access or higher to delete log files. This unauthorized data modification could lead to potential loss of important log information.

Impact

Exploitation of this vulnerability allows for unauthorized deletion of log files by authenticated users with Subscriber-level access or higher.

Remediation

Users are advised to update the Phrase TMS Integration for WordPress plugin to version 4.7.6 or a newer patched version.