Threats tagged 'ghsa-rxcc-hfjf-j3mp'

Clearfy Cache WordPress plugin versions before 2.4.3 have an improper access control vulnerability. This flaw allows any authenticated user, including low-privileged roles like Subscribers, to access admin-only settings pages and view their contents. The vulnerability arises because one admin-page dispatch path does not perform a capability check, although the canonical page URL does restrict access properly.