Threats tagged 'ghsa-32wc-jrqc-fp7p'

The All-in-One Video Gallery WordPress plugin versions before 5.1.0 have a vulnerability where the plugin does not verify the type, status, or ownership of posts before updating view count and duration metadata. This allows unauthenticated users to create or modify meta information on any post, including private and draft posts, and to arbitrarily inflate view counts.