Threats tagged 'ghsa-g256-5g3w-9rv9'

JS Help Desk WordPress plugin versions before 3.1.4 contain an authorization flaw where the plugin does not verify ownership of a targeted reply before allowing updates. This vulnerability permits any authenticated user with Subscriber role or higher to overwrite the content of any support-ticket reply on the site without proper authorization. The issue is classified as CWE-863 (Incorrect Authorization).