Threats tagged 'ghsa-p78j-pm32-q3pf'

The WP-Optimize WordPress plugin up to version 4.5.2 contains a vulnerability allowing authenticated users with author-level access or higher to delete arbitrary files on the server. This occurs due to insufficient validation of the 'original-file' meta key in the unscheduled_original_file_deletion function. Exploiting this can lead to remote code execution if critical files like wp-config.php are deleted.