Threats tagged 'ghsa-qr57-vj96-mp6j'

The Fiber Admin WordPress plugin versions before 4.0.1 contains a vulnerability where it does not validate or escape a request header before writing it into a PHP file during an unprotected admin hook. This flaw allows unauthenticated attackers to execute arbitrary code if the plugin's custom database error page is enabled and the attacker can win a race condition against an administrator saving settings.