Threats tagged 'ghsa-p7p5-59x2-5569'

The iChart WordPress plugin versions before 2.2.4 lack proper capability and ownership checks in multiple AJAX actions. Instead, they rely solely on a nonce accessible to any logged-in user, including those with the Subscriber role. This flaw allows such users to read, modify, and permanently delete arbitrary posts and overwrite a site-wide option.