Threats tagged 'ghsa-qgxr-8r3m-cw55'

GEO my WP WordPress plugin versions before 4.5.5.3 contain an authorization bypass vulnerability. The plugin fails to verify ownership or capability on two logged-in AJAX actions, allowing users with subscriber-level access or higher to modify or delete geolocation records of other users and posts by supplying arbitrary record IDs. This vulnerability has a medium severity rating with a CVSS score of 4.3.