Hariom Singh

The Mine CloudVod WordPress plugin before 2.6.6 does not restrict who can request cloud storage upload credentials from several of its REST API routes, allowing unauthenticated attackers to obtain signed upload policies and temporary credentials for the site's configured Alibaba Cloud OSS, Tencent Cloud COS and Dogecloud accounts and use them to upload or overwrite files in the site's storage.

The iChart WordPress plugin before 2.2.4 does not perform capability or ownership checks in several of its AJAX actions, relying only on a nonce that any logged-in user can obtain, allowing users with a role as low as Subscriber to read, modify and permanently delete arbitrary posts and to overwrite a site-wide option.

Verificações de capacidade insuficientes ao lidar com alterações de endereço de doadores permitem que usuários com acesso `donor-report` (visualização), que não possuem permissões de `donor-edit`, adicionem, modifiquem ou excluam o endereço armazenado de qualquer doador no site.