Threats tagged 'ghsa-jgh8-9xrh-qc6w'

The Content Egg plugin for WordPress up to version 12.0.0 contains an authorization bypass vulnerability. Authenticated users with author-level access or higher can exploit this flaw to create posts attributed to other users, including administrators, by manipulating the preset_id parameter. This allows lower-privileged users to create published posts under an administrator's name if they have the publish_posts capability for the relevant post type.