Access violation vulnerability in BadgeOS 3.7.1.6

The BadgeOS plugin for WordPress, up to and including version 3.7.1.6, is vulnerable to attack. This vulnerability allows an authenticated user with permission levels of at least “subscriber” to delete any post. This is because the plugin does not include proper validation and authorization checks in the functions badgeos_delete_step_ajax_handler, badgeos_delete_award_step_ajax_handler, badgeos_delete_deduct_step_ajax_handler, and badgeos_delete_rank_req_step_ajax_handler.