12 Step Meeting List < 3.16.6 - Missing Authorization to Authenticated (Contributor+) Arbitrary Content Deletion

Description

The 12 Step Meeting List plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the wp_ajax_tsml_delete() function in all versions up to, and including, 3.16.5. This makes it possible for authenticated attackers, with Contributor-level access and above, to delete all meeting data.