Authenticated arbitrary post deletion via unchecked IDs

Authorization bypass in Inisev Copy & Delete Posts before 1.5.5 allows remote authenticated users to permanently delete arbitrary posts. The cdp_action_handling AJAX path accepts attacker-selected post IDs for delete_posts and schedules permanent deletion without checking authorization for each post. Exploitation requires an administrator to enable plugin access for the attacker's role, an off-by-default setting; affected users can delete published, draft, and private posts owned by others.