Threats tagged 'ghsa-cwrh-6w94-5384'

The FV Flowplayer Video Player WordPress plugin versions before 7.5.56.7212 contain an authorization flaw that allows authenticated users with Contributor-level access or higher to modify or delete video and metadata records belonging to other users. This occurs because the plugin does not properly verify record ownership before permitting such actions. The vulnerability also allows disclosure of associated metadata in responses.