Threats tagged 'ghsa-xf49-c2ph-74x9'

The Post Duplicator WordPress plugin versions prior to 3.0.18 contain a vulnerability where the plugin does not properly validate capabilities assigned to roles via its permissions settings. This flaw allows a site administrator on a multisite network, who is not a Super Admin, to grant arbitrary capabilities to any role, including network-management capabilities that should be restricted to Super Admins.