Threats tagged 'ghsa-47mm-r6vq-p9g4'

The Smush WordPress plugin versions before 4.3.6 have an authorization flaw where users with the Author role or higher can optimize and restore media attachments owned by other users. This occurs because the plugin only checks a broad upload-files capability rather than verifying specific ownership or authorization for the targeted media. This allows unauthorized modification of other users' media files and consumption of stored backups.