Threats tagged 'ghsa-qp7g-pcqj-v98x'

The ECS WordPress plugin versions before 4.3.13 lack proper authorization checks on dynamic repeater actions. This allows users with contributor-level or higher accounts to read, modify, and delete binding configurations of posts they do not own and to alter site-wide presets. The vulnerability arises from relying solely on a nonce that is accessible to any user who can open the page builder, without verifying capability or ownership.