2 matches found
Deeper Comments <= 2.1.1 - Subscriber+ Arbitrary Options Update
Description The plugin does not have authorisation in its updateoptions AJAX action, allowing any authenticated users, such as subscribers to update arbitrary blog options like defaultrole etc...