Threats tagged 'ghsa-f2vj-4wgw-64cp'

The AZEXO Store Locator WordPress plugin versions through 1.4 contain a vulnerability where AJAX actions lack capability and nonce checks and fail to sanitize a request header used in file path construction. This flaw allows any authenticated user, including low-privileged roles like subscribers, to write files with arbitrary names, locations, and content, potentially leading to remote code execution.