Threats tagged 'ghsa-hrw5-8ff3-3cgr'

The OpenStation: Desktop Windows, Dock & Virtual Desktops for WP Admin WordPress plugin contains an authorization bypass vulnerability in all versions up to and including 1.1.16. This flaw allows authenticated users with subscriber-level access or higher to modify other users' placement rows and read serialized metadata of referenced entities. Exploitation requires the presence of orphaned placements, a state created by the plugin's trash cascade mechanism, and the attacker must enable OpenStation via an AJAX endpoint accessible with minimal privileges.