Threats tagged 'ghsa-76v9-x458-g8p9'

The WP Remote Users Sync WordPress plugin versions before 2.2.1 lack authorization and CSRF protections in one of their AJAX actions. This vulnerability allows any authenticated user, including low-privilege roles such as subscribers, to delete the plugin's entire activity log.