Incorrect Permissions in Ultimate Addons for Elementor Notice Dismissal

The bundled Astra Notices library passed the client-supplied notice identifier straight to update_user_meta() and set_transient() when an admin notice was dismissed, without checking it against the notices the plugin had actually registered. An authenticated user could therefore overwrite arbitrary keys of their own user metadata - including... Weiterlesen