Threats tagged 'ghsa-vf59-qh8h-wqpf'

The SEOJuice WordPress plugin versions before 2.12.0 have a vulnerability where the REST API authentication filter is not properly restricted. This flaw disables WordPress's REST nonce protection site-wide, allowing unauthenticated attackers to perform any cookie-authenticated REST action. An attacker can exploit this by tricking a logged-in administrator into visiting a crafted page, enabling actions such as creating a new administrator account via CSRF.