Threats tagged 'ghsa-g482-6rxp-qvg7'

The IDonate WordPress plugin versions 2.0.0 through 2.1.9 contain an Insecure Direct Object Reference vulnerability in the admin_post_donor_delete() function. Authenticated users with Subscriber-level access or higher can exploit this flaw by supplying arbitrary user_id values to the wp_delete_user() function, enabling deletion of arbitrary user accounts, including administrators.