Threats tagged 'ghsa-82vf-3973-8g6r'

The User Registration & Membership plugin for WordPress up to version 5.1.4 has a vulnerability that allows authenticated users with Contributor-level access or higher to modify data without proper authorization. This is due to a missing capability check in the embed_form_action() function, enabling such users to append shortcode content to pages they do not own or have permission to edit.