Vendor
The CourseCure Courses WordPress plugin contains a privilege escalation vulnerability in the ajax_save_settings function, allowing authenticated subscribers to elevate privileges to administrator by modifying arbitrary WordPress options.