Threats tagged 'ghsa-59c3-wg76-7px2'

The Advanced Custom Fields: Extended (ACFE) plugin for WordPress up to version 0.9.2.6 contains an authorization bypass vulnerability. This flaw allows unauthenticated attackers to delete arbitrary media library attachments by submitting a crafted form with a numeric attachment ID, bypassing ownership and capability checks. Exploitation requires a site administrator to have configured a public-facing ACFE form with an Email action that includes a deletable attachment field bound to user input.