logo
DATABASE RESOURCES PRICING ABOUT US

HTML2WP <= 1.0.0 - Subscriber+ Arbitrary File Deletion

Description

The plugin does not have authorisation and CSRF checks in an AJAX action, available to any authenticated users such as subscriber, which could allow them to delete arbitrary file


Related