Threats tagged 'ghsa-hjqg-w7m7-3cch'

The Tainacan WordPress plugin versions up to and including 1.3.0 contain a directory traversal vulnerability via the 'tmp_file' parameter. Authenticated users with editor-level or higher privileges can exploit this flaw to read arbitrary files on the server. The vulnerability arises because a manipulated importer path is stored in the database and later accessed through a GET request to the /source_info endpoint, which reads and returns file contents via fopen() and fgetcsv().