Threats tagged 'ghsa-cw6m-jprq-gmcm'

The Mine CloudVod WordPress plugin versions prior to 2.6.6 allow unauthenticated attackers to request cloud storage upload credentials via certain REST API routes. This vulnerability enables attackers to obtain signed upload policies and temporary credentials for Alibaba Cloud OSS, Tencent Cloud COS, and Dogecloud accounts configured on the site, potentially allowing them to upload or overwrite files in the site's cloud storage.