Kevin Murphy

The issue is related to a missing capability check on the `pubnews importer plugin action for notice()` function, allowing authenticated attackers with Subscriber-level access and above to install arbitrary plugins. This can be leveraged to exploit other vulnerabilities.

The issue is related to unauthorized arbitrary plugin installation due to a missing capability check on the `top store install and activate callback()` function. This allows authenticated attackers, with subscriber-level access and above, to install arbitrary plugins, which can contain other exploitable vulnerabilities to elevate privileges and gain remote code execution.

The Th Shop Mania theme for WordPress has a vulnerability due to a missing capability check on the `th shop mania install and activate callback()` function. This allows authenticated attackers with Subscriber-level access and above to install arbitrary plugins, which can be leveraged to exploit other vulnerabilities and achieve remote code execution and privilege escalation.