Threats tagged 'ghsa-x76m-c6rr-jrhw'

The Duplicate Post WordPress plugin before version 1.5.8 contains an authorization flaw where it does not verify if a user duplicating a post has permission to edit that post. When the slug takeover option is enabled, this allows users with roles granted access by an administrator, such as Contributor, to move any readable post off its original permalink and publish their duplicate at that address.