2J SlideShow < 1.3.40 - Authenticated Arbitrary Plugin Deactivation
Description
Lack of authorisation checks in the twoj_slideshow_setup() function registered as an AJAX call could allow authenticated users with low privileges to deactivate arbitrary plugins.
Affects Plugins
Fixed in version 1.3.40✓
Classification
Miscellaneous
Original Researcher
Jerome Bruandet (nintechnet.com)
Verified
No
Timeline
Publicly Published
2020-01-20 (about 2 years ago)
Added
2020-01-20 (about 2 years ago)
Last Updated
2020-01-21 (about 2 years ago)