Threats tagged 'ghsa-w86f-f8mj-wm7p'

The Page & Post Notes plugin for WordPress contains a vulnerability that allows unauthorized modification of notes. This occurs due to a missing capability check in the 'yydev_notes_save_dashboard_data' function. Authenticated users with Subscriber-level access or higher can exploit this flaw to modify notes without proper authorization. The issue affects all versions up to and including 1.3.4.