Woo Slider Pro WordPress Plugin Missing Authorization Vulnerability Allows Arbitrary Post Deletion

A vulnerability exists in the Woo Slider Pro – Drag Drop Slider Builder For WooCommerce plugin for WordPress, in all versions through 1.12. The issue arises from a missing capability check on the woo_slide_pro_delete_draft_preview AJAX action, allowing authenticated attackers with Subscriber-level access and above to delete arbitrary posts.

Impact

Exploitation of this vulnerability allows for unauthorized deletion of posts by authenticated users with Subscriber-level access or higher.