Threats tagged 'ghsa-r29v-jf4c-hpxx'

The Advanced Members for ACF WordPress plugin versions up to and including 1.3.0 contain a privilege escalation vulnerability. This flaw arises from a PHP operator-precedence bug that causes an authorization check to incorrectly pass for any logged-in user. As a result, attackers with Subscriber-level access or higher can reset the password of the primary administrator account (user ID 1), gaining full administrative control of the site.