Threats tagged 'ghsa-hhj5-vff4-phcr'

The Qi Blocks WordPress plugin up to version 1.4.3 has a vulnerability due to missing capability checks in the resize_image_callback() function. Authenticated users with Contributor-level access or higher can resize media library images belonging to other users without proper authorization. This flaw can lead to unintended file writes, excessive disk usage, and server resource abuse by processing large images.