Threats tagged 'ghsa-vv63-8qc6-4h36'

The Dynific Addons for Elementor WordPress plugin before version 1.3.1 has a vulnerability where it does not properly check user status or capabilities when resolving post identifiers in a shortcode. This allows authenticated users with at least the Contributor role to access draft, private, and password-protected posts of other users. Additionally, users with the Author role can republish this content to anonymous visitors.