Threats tagged 'ghsa-9pxh-r9hv-cxqf'

The Mobile builder plugin for WordPress versions up to and including 1.4.2 contains a privilege escalation vulnerability. This flaw arises from a PHP loose-comparison logic error in the meta key allow-list check combined with insufficient permission verification that allows any authenticated user to modify their own user meta data. Exploiting this, an attacker with Subscriber-level access or higher can escalate their privileges to Administrator by overwriting the wp_capabilities meta key.