Coditor <= 1.1 - Arbitrary File Edition, Deletion and Internal Directory Listing in wp-content

Description

The coditor_process_ajax() AJAX call is missing any CSRF and authorisation checks, allowing low privilege users (subscriber+) to read and edit any files in the wp-content folder, as well as list its content.