Threats tagged 'ghsa-7v79-ff47-vhhm'

GiveWP WordPress plugin versions before 4.19.0.1 contain an authorization flaw that allows users with a custom fundraising role to edit, publish, and read pages owned by other users, including administrators. This occurs because the plugin does not correctly determine which page a page-capability request applies to.