Threats tagged 'ghsa-rq7c-4vhw-wv57'

The Ak Framework plugin for WordPress, included in the Newsy - Viral News & Magazine WordPress Theme, contains a privilege escalation vulnerability in all versions up to and including 2.9.8. The flaw arises from missing capability checks in certain AJAX handlers, allowing unauthenticated attackers to update arbitrary WordPress options. This can enable attackers to escalate privileges to administrator by setting user registration to enabled with the default role as administrator.