WordPress Delete All Posts Plugin Broken Access Control Vulnerability

A broken access control vulnerability has been identified in the WordPress Delete All Posts plugin, specifically in versions through 1.1.1. This vulnerability allows unauthorized users to exploit improperly configured access control settings, potentially leading to the execution of actions reserved for higher privileged users.

Impact

Exploitation of this vulnerability could allow an unauthorized user to perform actions that require higher privileges, such as deleting posts.

Remediation

Users of the WordPress Delete All Posts plugin are advised to update to the latest version. For those unable to update immediately, Patchstack has issued a virtual patch that blocks attacks targeting this vulnerability.