Threats tagged 'ghsa-pjj3-fc28-8c9m'

The Motors WordPress plugin (up to version 1.4.128) contains a file deletion vulnerability allowing authenticated users with Subscriber-level access or higher to delete image files belonging to other users within the uploads directory. This occurs due to improper ownership checks on a user meta field that accepts attacker-controlled input, enabling deletion of avatars, dealer logos, and uploaded media. The vulnerability is limited to image files within the uploads directory and does not affect files outside this path.