Threats tagged 'ghsa-fg39-9fxr-gr5f'

The Crop Thumbnails WordPress plugin versions before 1.10.0 lack proper object-level authorization when reading and re-cropping media attachments. This flaw allows any authenticated user with the upload capability, such as the default Author role, to access and modify metadata and thumbnail files of media attachments owned by other users.