PT-2022-9570 · WordPress · Qubely

Name of the Vulnerable Software and Affected Versions: Qubely WordPress plugin versions prior to 1.7.8 Description: The issue concerns a lack of authorization and CSRF check on the "qubely delete saved block" AJAX action. This allows any authenticated user, such as a subscriber, to delete arbitra...