CartFlows <= 1.11.11 - Insecure Direct Object Reference to Arbitrary Post Deletion

The CartFlows plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 1.11.11. This is due to the fact that during cart flow deletion/modification, the plugin does not verify that the flow ID provided to the AJAX action is indeed a cart flow id. This makes it possible for authenticated attackers, with cart flow manager access or higher, to modify or delete arbitrary posts. This permission is by default available to admins, but can be given to other user types.