Threats tagged 'ghsa-2cxc-vpf5-w9j6'

The kallyas WordPress theme versions up to and including 4.24.0 contain a remote code execution vulnerability via the TH_PhpCode pagebuilder widget. This flaw allows authenticated users with Contributor-level access or higher to execute arbitrary code on the server because the theme does not restrict access to the code editor widget for non-administrators.