Description
The SoftMarket — Digital Marketplace WordPress plugin through 1.0.0 does not properly validate an authentication token in one branch of its email-verification flow, allowing unauthenticated attackers to obtain a valid session as any verified user by supplying only that user-s ID.
CVSS 9.1EPSS 0.35400000000000004%Risk 0.94
View source- Published
- 2026-08-03 07:16:39
- Last modified
- 2026-08-04 18:16:43
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N