The Woo Slider Pro plugin for WooCommerce suffers from a missing capability check on an AJAX action responsible for deleting draft previews. This lack of authorization verification enables authenticated users with low privileges (Subscriber-level and above) to delete arbitrary posts, potentially impacting data integrity. The CVSS 3.1 base score is 6.5, reflecting a medium severity with network attack vector, low attack complexity, and no user interaction required. Confidentiality and availability are not impacted, but integrity is high impacted due to unauthorized data modification.

Authenticated users with Subscriber-level privileges or higher can delete arbitrary posts without proper authorization. This can lead to unauthorized data modification and potential disruption of content management within affected WordPress sites using this plugin. There is no indication of confidentiality or availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user roles to trusted individuals only and monitor for suspicious activity related to post deletions. Avoid granting Subscriber-level or higher access to untrusted users. Follow updates from the plugin vendor for a forthcoming patch.