WordPress Page and Post Lister Missing Authorization Vulnerability Allowing Arbitrary Content Deletion

A missing authorization vulnerability has been identified in the WordPress Page and Post Lister plugin, specifically in versions through 1.2.1. This vulnerability allows for arbitrary content deletion by exploiting incorrectly configured access control security levels. As a result, a malicious actor could potentially delete various types of content from a website, including posts, pages, and images.

Impact

Exploitation of this vulnerability could lead to unauthorized deletion of content from the affected WordPress site, such as posts, pages, or media files.

Remediation

Users of the WordPress Page and Post Lister plugin are advised to update to the latest version. For those who cannot update immediately, Patchstack has issued a virtual patch that blocks attacks targeting this vulnerability.