Threats tagged 'ghsa-9x7v-j6m2-2h5m'

The Travelly – Tour & Travel Booking Manager for WooCommerce plugin for WordPress versions up to 2.3.6 contains an authorization bypass vulnerability. Authenticated users with contributor-level access or higher can exploit this flaw to duplicate arbitrary posts, including private, draft, and pending posts authored by higher-privileged users. This duplication exposes sensitive content such as the original post's content, excerpt, title, taxonomies, and metadata. The vulnerability arises because the plugin does not properly verify user authorization and uses a static nonce action that is not bound to specific posts, allowing nonce reuse against any post ID.