Threats tagged 'ghsa-cj67-wfx5-m7pp'

The Ever Accounting WordPress plugin versions before 2.3.3 contain a vulnerability in the CSV import routine that fails to restrict file paths to an allowed directory. This flaw allows users with the custom Accounting Manager role, which lacks administrator privileges, to delete arbitrary files on the server, including critical files like wp-config.php, potentially taking the entire site offline.