Threats tagged 'ghsa-2gm6-cf3j-36f9'

The Realty Portal plugin for WordPress versions 0.1 through 0.4.1 contains a vulnerability that allows authenticated users with Subscriber-level access or higher to modify data without proper authorization. This is due to a missing capability check in the 'rp_save_property_settings' function. Exploiting this flaw, attackers can change site options such as the default user role to administrator and enable user registration, thereby escalating their privileges to gain administrative access.