Threats tagged 'ghsa-g34q-c4r9-fwhj'

The Events Manager WordPress plugin before version 7.4 has a vulnerability where it does not perform authorization checks on a REST route that serves temporarily stored file uploads. This flaw allows unauthenticated users to access another user's in-progress upload if they know the temporary high-entropy identifier. However, the identifier is only disclosed to the uploader, and files are removed upon submission or scheduled cleanup, limiting the risk of unauthorized access by guessing alone.