Threats tagged 'ghsa-xrrq-7x9p-r92r'

The All in One Files Upload WordPress plugin versions before 2.0.17 lack capability checks and do not verify request authenticity when saving settings. This flaw allows any authenticated user, including low-privilege roles such as subscribers, to modify plugin settings.