Threats tagged 'ghsa-m4vj-2mv4-rv7p'

The Custom Block Builder WordPress plugin versions before 3.0.0 contain a vulnerability where unauthorized requests to its REST API routes are not properly denied. This occurs because the plugin's permission checks return a non-error response that WordPress interprets as authorization granted. As a result, unauthenticated users can execute arbitrary PHP code on the server.