Nikita Mateo Volovik

Incorrectly configured access control security levels allow authenticated attackers with contributor-level access and above to perform unauthorized actions. This is caused by a missing capability check in a function.

Incorrectly configured access control security levels allow for unauthorized access due to a missing capability check in a function. This enables unauthenticated attackers to perform unauthorized actions.

An SQL Injection issue exists due to insufficient escaping of user-supplied parameters and a lack of proper preparation of SQL queries. Authenticated attackers with subscriber-level access or higher can append additional SQL queries to existing ones to extract sensitive information from the database.