WordPress TS-Tree Plugin Missing Authorization Vulnerability Allowing Arbitrary Content Deletion

A missing authorization vulnerability has been identified in the WordPress TS-Tree plugin, specifically in versions through 0.1.1. This vulnerability allows for arbitrary content deletion by exploiting incorrectly configured access control security levels.

Impact

Exploitation of this vulnerability could lead to unauthorized deletion of content, such as posts, pages, or media, from the affected WordPress site.

Remediation

Users of the WordPress TS-Tree plugin are advised to update to version 0.1.1 or later. For those unable to update immediately, Patchstack has issued a virtual patch that blocks attacks targeting this vulnerability.