The Woo Slider Pro – Drag Drop Slider Builder For WooCommerce plugin contains a missing capability check on the woo_slide_pro_delete_draft_preview AJAX action. This flaw allows any authenticated user with Subscriber level access or higher to delete arbitrary posts, effectively compromising content integrity. The vulnerability is a Missing Authorization weakness (CWE‑862) and is classified as a Medium severity issue with a CVSS score of 6.5.

This issue affects WordPress sites running the bc2018 Woo Slider Pro plugin, versions up to and including 1.12. The plug‑in’s action is exposed through its administrative AJAX interface, and the flaw exists in all releases prior to 1.13.

The EPSS score is less than 1 %, indicating a low likelihood that attackers exploit this flaw. The vulnerability is not listed in the CISA KEV catalog. The attack vector requires an authenticated session; an attacker can trigger the vulnerable AJAX endpoint from any page where the role has been granted, leading to unintended deletion of content. The risk is moderate, driven by the potential for data loss, but limited by the low exploitation probability and lack of public exploit evidence.