Threats tagged 'ghsa-wgfj-q3jr-6q45'

10up Distributor versions prior to 2.3.2 have a missing authorization vulnerability in the ajax_push() function. This flaw allows Contributor-level multisite users to publish posts on other network sites without proper permissions by exploiting the dt-push nonce with a chosen connection ID and post status. The vulnerability enables unauthorized creation of draft or published posts on sites the attacker cannot normally access.