Three WordPress admin AJAX handlers performed no per-object authorization check. On multisite, a Site Administrator could network-activate a plugin the network administrator had reserved as Network-only, because wp_ajax_activate_plugin() never verified the manage_network_plugins capability and is_network_only_plugin() resolved its argument... Weiterlesen
Intelligence View
Missing Authorization Checks in WordPress Admin AJAX Endpoints
Three WordPress admin AJAX handlers performed no per-object authorization check. On multisite, a Site Administrator could network-activate a plugin the network administrator had reserved as Network-only, because wp_ajax_activate_plugin()…
SOCIAL SHARE CARD GENERATOR