Threats tagged 'ghsa-2qqm-h6h2-8xxq'

The Directorist WordPress plugin versions before 8.11 contain a vulnerability where the plugin does not verify ownership of attachment IDs when updating listing images. This flaw allows authenticated users with Subscriber-level access or higher to permanently delete arbitrary media library attachments, including those uploaded by administrators, along with their associated files.