Threats tagged 'ghsa-xcqr-f8gx-c54m'

The Advance Guest Post WordPress plugin up to version 1.9 has a vulnerability where it does not perform authorization or ownership checks when deleting media attachments. It relies solely on a nonce that is exposed to all site visitors, enabling unauthenticated users to permanently delete arbitrary media library attachments and their files.