Threats tagged 'ghsa-6w6x-m5fr-mppc'

The Download Panel plugin for WordPress versions up to and including 1.3.3 has a vulnerability that allows authenticated users with Subscriber-level access or higher to modify plugin settings without proper authorization. This occurs because the plugin's 'wp_ajax_save_settings' AJAX action lacks a capability check, enabling unauthorized changes to display text, download links, button colors, and other visual customizations.