Moosend Landing Pages WordPress Plugin Missing Authorization Vulnerability Allowing Option Deletion

A vulnerability exists in the Moosend Landing Pages plugin for WordPress, in all versions through 1.1.6. The issue arises from a missing capability check in the 'moosend_landings_auth_get' function, allowing authenticated attackers with Subscriber-level access or higher to delete the 'moosend_landing_api_key' option.

Impact

Exploitation of this vulnerability allows for unauthorized deletion of the 'moosend_landing_api_key' option, potentially disrupting the functionality that relies on this API key.