Threats tagged 'ghsa-wmc8-xv69-488r'

The WP Remote Users Sync WordPress plugin versions before 2.2.0 improperly restrict access to user export files stored under the public web root. This issue arises because the plugin relies on an Apache-specific access control file, which is ineffective on other web servers like Nginx. Consequently, an unauthenticated attacker can access these export files by requesting their predictable filenames, potentially exposing personal user data.