Threats tagged 'ghsa-72jg-c386-7wmv'

The WP AUDIO GALLERY WordPress plugin up to version 2.0 contains a vulnerability that allows authenticated users with subscriber-level access or higher to delete arbitrary files on the server. This occurs because the plugin's AJAX handler does not properly validate file paths before deleting files, potentially enabling deletion of critical files such as wp-config.php. The vulnerability has a high severity score of 8.1 CVSS 3.1 and can lead to remote code execution if exploited.