title: OoohBoi Steroids for Elementor < 2.1.5 - Subscriber+ Attachment Deletion
description: The OoohBoi Steroids for Elementor WordPress plugin before 2.1.5 has CSRF and broken access control vulnerabilities which leads user with role as low as subscriber to delete attachment.
problem types: CWE-862 Missing Authorization
affected:
{
vendor: Unknown
product: OoohBoi Steroids for Elementor
versions:
status: affected, versionType: custom, version: 0, lessThan: 2.1.5
defaultStatus: unaffected
collectionURL: https://wordpress.org/plugins
}