Threats tagged 'ghsa-m77w-m8qm-q9pv'

A privilege management vulnerability exists in the Subscriptions for WooCommerce WordPress plugin before version 2.0.1. The plugin fails to verify user capabilities properly before allowing installation and activation of plugins via a nonce-protected AJAX action. This flaw permits users with the Shop Manager role, who normally lack plugin management permissions, to install and activate arbitrary plugins, potentially leading to remote code execution.