YayCommerce YayCurrency Plugin Missing Authorization Vulnerability Allowing Arbitrary Content Deletion

A missing authorization vulnerability has been identified in the YayCommerce YayCurrency WordPress plugin, affecting versions through 3.3. This vulnerability arises from incorrectly configured access control security levels, allowing unauthorized users to delete arbitrary content, such as posts, pages, or media, from affected websites.

Impact

Exploitation of this vulnerability could lead to unauthorized deletion of content from WordPress sites, including posts, pages, and media files.

Remediation

Users of the YayCurrency WordPress plugin should update to version 3.3.1 or later to address this vulnerability. Patchstack users can enable auto-update for vulnerable plugins.