Threats tagged 'ghsa-w6hx-92x2-67r3'

The All in One SEO plugin for WordPress contains a vulnerability that allows authenticated users with Contributor-level access or higher to delete arbitrary media attachments without proper authorization checks. This issue affects all versions up to and including 4.8.9 and arises from insufficient permission validation in the REST API endpoint `/wp-json/aioseo/v1/ai/image-generator`. The vulnerability does not impact confidentiality or availability but allows unauthorized modification of media content.