The /1/api/ulisting-user/deletelisting REST route did not have any authorisation and CSRF checks in place, allowing unauthenticated usesr to delete any page or post.
2021-01-28 (about 2 years ago)
2021-01-28 (about 2 years ago)
2021-01-29 (about 2 years ago)