Description
Insufficient capability checks made it possible to disable badges a user does not have permission to access.
Remediation
References
Related Vulnerabilities
WordPress Plugin Zingiri Web Shop 'ajax_save_name.php' Remote Code Execution (2.2.3)
WordPress Plugin Custom 404 Pro Cross-Site Scripting (3.2.7)
WordPress Plugin Gutenberg Blocks by WordPress Download Manager Cross-Site Scripting (2.1.8)
WordPress Plugin Blogroll Fun-Show Last Post and Last Update Time Cross-Site Scripting (0.8.4)