Gutenberg Template Library & Redux Framework < 4.2.13 - Contributor+ Arbitrary Plugin Installation and Post Deletion

The plugin did not correctly check the authorisation in the redux/v1/templates/ REST API namespace, allowing any users with the edit_posts capability (ie contributor and above) to call the endpoints define in it. By using the redux/v1/templates/plugin-install one, they could install plugins from the WordPres repository, or delete arbitrary posts/pages via redux/v1/templates/delete_saved_block