Threats tagged 'ghsa-qvmw-9jwc-9q89'

The Duplicate Post WordPress plugin versions before 1.5.8 lack a proper capability check when saving global settings. Instead, they rely solely on their own role-access list, which can be manipulated by users with any role granted access by an administrator, including low-privilege roles such as Subscriber. This flaw allows such users to overwrite global settings, including the role-access list itself.