Threats tagged 'ghsa-pjq2-4h9c-99m5'

The WPCOM Member plugin for WordPress contains a Local File Inclusion (LFI) vulnerability in all versions up to and including 1.7.14. This flaw allows authenticated users with Contributor-level access or higher to include and execute arbitrary PHP files on the server via the action parameter in a shortcode. Exploitation can lead to bypassing access controls, exposure of sensitive data, or remote code execution if PHP files can be uploaded and included.