WordPress WPLingo Plugin Missing Authorization Vulnerability Allowing Arbitrary Content Deletion

A missing authorization vulnerability has been identified in the WordPress WPLingo plugin, specifically in versions through 1.1.2. This vulnerability allows for arbitrary content deletion by exploiting incorrectly configured access control security levels. As a result, malicious actors could potentially delete various types of content from affected websites, such as posts, pages, or media files.

Impact

Exploitation of this vulnerability could lead to unauthorized deletion of content from the affected WordPress site, including posts, pages, or media files.

Remediation

Users of the WPLingo WordPress plugin are advised to update to the latest version. For those unable to update immediately, Patchstack has issued a virtual patch that blocks attacks targeting this vulnerability. This virtual patch can be activated by subscribing to Patchstack's WordPress security service.