Threats tagged 'ghsa-xhwv-738r-4942'

The Broken Link Checker plugin by AIOSEO for WordPress has an authorization vulnerability in all versions up to and including 1.2.5. Authenticated users with contributor-level access or higher can exploit a REST API endpoint to trash arbitrary posts without proper permission checks. This occurs because the plugin only verifies a broad capability granted to contributors but does not confirm if the user has rights over the specific post targeted.