Threats tagged 'ghsa-v86c-jgq8-6hrh'

The WP Data Access – App Builder plugin for WordPress contains an Incorrect Authorization vulnerability in all versions up to and including 5.5.89. This flaw allows authenticated users with Subscriber-level access or higher to bypass write restrictions and modify arbitrary database rows and columns, including the administrator's password. Exploitation requires that an administrator has published a Data App enabling write transactions for Subscriber-level or anonymous users. Unauthenticated exploitation is possible only if the Data App is configured with anonymous REST API authorization and enabled write transactions. This vulnerability can lead to full site takeover by escalating privileges to administrator.