Authorization Bypass in 2J-SlideShow Plugin for WordPress

CVE-2020-36729

Summary

The 2J-SlideShow Plugin for WordPress is susceptible to an authorization bypass due to a missing capability check in the 'twoj_slideshow_setup' function. This vulnerability allows authenticated users, such as those with Subscriber level access or higher, to execute restricted actions, including deactivating any installed plugins on a WordPress site. It affects versions up to and including 1.3.31, potentially exposing sites to unauthorized control and manipulation.

References