Location Picker at Checkout for WooCommerce < 1.9.0 - Missing Authorization via checkout_map_rules_order_ajax_handler

Description The Location Picker at Checkout for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the checkout_map_rules_order_ajax_handler function in versions up to, and including, 1.8.9. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify rule orders.