Threats tagged 'ghsa-cg38-f4xr-fwg3'

The GiveWP WordPress plugin up to version 4.19.1 contains a privilege escalation vulnerability via improper sanitization of the donor_default_user_role parameter. Authenticated users with the GiveWP Manager role or higher can assign elevated WordPress roles, including Administrator, to new donor accounts through an import JSON path that bypasses sanitization. This allows unauthorized assignment of privileged roles to new users.