WordPress ArtPlacer Widget plugin < 2.21.2 - Subscriber+ Arbitrary Widget Deletion vulnerability

Subscriber+ Arbitrary Widget Deletion vulnerability discovered by Bob Matyas in WordPress Plugin ArtPlacer Widget versions 2.21.2...

CVE-2023-7268 ArtPlacer Widget < 2.21.2 - Subscriber+ Arbitrary Widget Deletion

The ArtPlacer Widget WordPress plugin before 2.21.2 does not have authorisation check in place when deleting widgets, allowing ay authenticated users, such as subscriber, to delete arbitrary widgets...

CVE-2023-7268

The ArtPlacer Widget WordPress plugin versions prior to 2.21.2 is vulnerable to a Broken Access Control issue (CWE-862). The root cause is a missing authorization check during the widget deletion process, which allows any authenticated user, including those with Subscriber privileges, to delete a...

CVE-2023-7268: Missing Authorization

The ArtPlacer Widget WordPress plugin before 2.21.2 does not have authorisation check in place when deleting widgets, allowing ay authenticated users, such as subscriber, to delete arbitrary widgets...