Threats tagged 'ghsa-2c2g-q6hp-xc6q'

The JS Help Desk plugin for WordPress up to version 5.0.1 contains a vulnerability that allows authenticated administrators to delete arbitrary files on the server due to insufficient validation of file paths in the setSupportCustomImage function. Exploitation involves a two-step process where an attacker first sets a crafted path in a configuration field and then triggers deletion by uploading a new image. This can lead to remote code execution if critical files like wp-config.php are deleted.