Threats tagged 'ghsa-78vr-8fpj-r56x'

The Sender plugin for WordPress versions before 2.11.3 has a missing authorization vulnerability that allows any authenticated user, including low-privilege Subscribers, to access a sensitive diagnostic dump. This can be exploited by invoking the admin_post_sender_debug_download action without any capability, nonce, or referer checks, exposing detailed system and plugin information.