WPDashboardNotes < 1.0.11 - Unauthorised Deletion of Private Notes

Description The plugin is vulnerable to Insecure Direct Object References (IDOR) in post_id= parameter. Authenticated users are able to delete private notes associated with different user accounts. This poses a significant security risk as it violates the principle of least privilege and compromises the integrity and privacy of user data.

PoC

After attacker create a note, uses the delete option. Intercepts the request and manipulate the post_id= to the victim note. action=wpdn_delete_note&post;_id=&nonce;=1aa16d2949