Threats tagged 'ghsa-r4wx-vxrq-8xm2'

The iLeads SMS Gateway WordPress plugin before version 2.0.0 contains a vulnerability where several AJAX actions do not verify user capabilities or nonces. This flaw allows any authenticated user, including low-privileged roles such as subscribers, to modify arbitrary WordPress site options. An attacker can exploit this to escalate privileges to administrator, for example by enabling user registration with the administrator role as default.