Code for Recovery 12 Step Meeting List Missing Authorization Vulnerability Allowing Arbitrary Content Deletion

A missing authorization vulnerability has been identified in the Code for Recovery 12 Step Meeting List WordPress plugin, affecting versions through 3.16.5. This vulnerability allows exploitation of improperly configured access control security levels, leading to arbitrary content deletion. As a result, malicious actors could potentially remove posts, pages, or media from affected websites.

Impact

Exploitation of this vulnerability could result in the unauthorized deletion of content from a WordPress site, including posts, pages, or media files.

Remediation

Users of the Code for Recovery 12 Step Meeting List WordPress plugin should update to version 3.16.6 or later to address this vulnerability. Patchstack users can enable auto-update for vulnerable plugins.