Threats tagged 'ghsa-m836-p73r-8pm6'

The FV Flowplayer Video Player WordPress plugin versions prior to 7.5.57.7212 have a vulnerability where an AJAX action that performs a site-wide content rewrite lacks authorization checks. This allows any authenticated user, including those with subscriber-level access, to trigger bulk modifications of posts they normally cannot edit.