Threats tagged 'ghsa-334j-cwwv-qmmh'

The Royal MCP WordPress plugin versions before 1.5.10 lack proper object-level and post-type authorization checks in one of its search tools. This vulnerability allows authenticated users with low privileges, such as subscribers, to access the title and content of non-public entries, potentially exposing personal data stored by the plugin.