Threats tagged 'ghsa-94r9-pgqm-7rh9'

The Royal MCP WordPress plugin versions before 1.5.10 have a vulnerability where the plugin does not perform an object-level permission check before duplicating a requested page. This flaw allows users with contributor-level access to read the full content of any private or draft page and publish it without having the publish capability.