Threats tagged 'ghsa-66wj-j5w3-hw3x'

The NotificationX WordPress plugin versions before 3.3.7 lack capability, authentication, and nonce checks on its notification preview path. This flaw allows unauthenticated users to view private, draft, pending, and password-protected post content and execute arbitrary registered shortcodes by sending crafted preview data in front-end requests.