Threats tagged 'ghsa-38v2-q8r5-xfrm'

The 6Storage Rentals WordPress plugin contains an authentication bypass vulnerability in all versions up to and including 2.31.0. This flaw allows users with Subscriber-level access or higher to authenticate as any existing WordPress user, including administrators, by exploiting unsecured AJAX handlers that lack capability checks and nonce verification. The vulnerability stems from an incomplete fix of a prior issue, enabling full site compromise through crafted AJAX requests.