Threats tagged 'ghsa-4mg2-rgw7-wvrm'

The EventPrime WordPress plugin versions up to 4.2.0.0 have a vulnerability that allows authenticated users with Subscriber-level access or higher to add unauthorized notes to any booking. This occurs due to a missing capability check in the booking_add_notes function, enabling note creation without proper authorization.