Wpzoom Portfolio Lite
Monthly
Broken access control in WPZOOM Portfolio Lite before 1.4.34 allows authenticated users with the WordPress Contributor role or higher to convert other users' posts and pages into portfolio items, altering order and removing the content from its original listings and URLs. The flaw requires only a low-privilege account and no victim interaction, so it is most impactful on multi-author sites or those with open contributor registration; publicly available exploit code exists. The vendor has released version 1.4.34 to address the missing authorization check.
Broken access control in WPZOOM Portfolio Lite before 1.4.34 allows authenticated users with the WordPress Contributor role or higher to convert other users' posts and pages into portfolio items, altering order and removing the content from its original listings and URLs. The flaw requires only a low-privilege account and no victim interaction, so it is most impactful on multi-author sites or those with open contributor registration; publicly available exploit code exists. The vendor has released version 1.4.34 to address the missing authorization check.