Aeropage Sync for Airtable Missing Authorization Vulnerability Allowing Arbitrary Post Deletion

A vulnerability exists in the Aeropage Sync for Airtable WordPress plugin, in versions through 3.2.0, allowing authenticated users with Subscriber-level access or higher to delete any post. This issue arises from a lack of proper capability checks in the 'aeropageDeletePost' function, leading to unauthorized data loss.

Impact

Exploitation of this vulnerability allows for arbitrary post deletion, potentially leading to loss of important content or data.

Reproduction

To reproduce this vulnerability, an authenticated user with Subscriber-level access or higher can send a request to the 'aeropageDeletePost' AJAX action. This request can include the ID of the post to be deleted. The absence of a capability check in the targeted function will result in the specified post being deleted, regardless of the user's authorization level.

Remediation

Users are advised to update the Aeropage Sync for Airtable plugin to version 3.3.0 or later, where this vulnerability has been patched.