WordPress WP Lead Capturing Pages Plugin Missing Authorization Vulnerability Allowing Arbitrary Content Deletion

A missing authorization vulnerability has been identified in the WordPress WP Lead Capturing Pages plugin, affecting versions through 2.3. This vulnerability allows exploitation of improperly configured access control, leading to arbitrary content deletion. An unauthenticated user could potentially delete various types of content from the website, such as posts, pages, or media.

Impact

Exploitation of this vulnerability could result in unauthorized deletion of content from the affected WordPress site, including posts, pages, or media files.

Remediation

Users of the WP Lead Capturing Pages plugin are advised to update to version 2.3 or later. For those unable to update immediately, Patchstack offers a virtual patch that can be applied to mitigate this vulnerability until an official update is available.