Description
The ajax component was excluded from the default logged-in-user check in the administrative area. This behavior was potentially unexpected by 3rd party developers.
Remediation
References
Related Vulnerabilities
WordPress Plugin DX-Contribute Cross-Site Request Forgery (1.2.0)
WordPress Plugin BuddyPress Unspecified Vulnerability (2.6.0)
MySQL CVE-2015-0511 Vulnerability (CVE-2015-0511)
WordPress Plugin Photoracer Multiple Cross-Site Scripting and SQL Injection Vulnerabilities (1.0)
WordPress Plugin Simple Matted Thumbnails Cross-Site Scripting (1.01)