title: myStickymenu < 2.6.5 - Subscriber+ Arbitrary Form Leads Deletion
description: The myStickymenu WordPress plugin before 2.6.5 does not adequately authorize some ajax calls, allowing any logged-in user to perform the actions.
problem types: CWE-862 Missing Authorization
affected:
{
vendor: Unknown
product: Floating Notification Bar, Sticky Menu on Scroll, Announcement Banner, and Sticky Header for Any Theme
versions:
status: affected, versionType: semver, version: 0, lessThan: 2.6.5
defaultStatus: unaffected
collectionURL: https://wordpress.org/plugins
}