Threats tagged 'ghsa-gmmp-4j2q-5jgv'

The Surfer WordPress plugin versions before 1.8.1.759 expose a sensitive API credential on the post editor page to users with contributor-level access and above. This credential is used as the sole authorization mechanism for privileged REST API actions, enabling these users to escalate their privileges to publish arbitrary posts and perform other restricted operations.