Bookingor WordPress Plugin Missing Authorization Vulnerability Allowing Category Deletion

A vulnerability exists in the Bookingor WordPress plugin, specifically in versions through 1.0.12. The issue arises because authenticated AJAX actions are exposed without proper capability or nonce checks. This oversight enables low-privileged users to delete categories associated with the Bookingor plugin.

Impact

Exploitation of this vulnerability allows for unauthorized deletion of Bookingor plugin categories by low-privileged users.

Reproduction

To reproduce this vulnerability, first add a category using the Bookingor WordPress plugin. Then, send a request to 'wp-admin/admin-ajax.php' with the 'bp_delete_category' action and the ID of the category to be deleted. Include the 'wordpress_logged_in' cookie to authenticate the request.