Popis
The Simple Membership WordPress plugin before 4.7.8 does not verify whether user creation failed during registration before using the returned value as a user ID to update an account, allowing unauthenticated attackers to overwrite the primary administrator-s account data (including the email address) and take over that account through the password reset flow.
CVSS 9.4EPSS 0.233%Riziko 0.96
Zobraziť zdroj- Zverejnené
- 2026-08-03 07:16:40
- Posledná úprava
- 2026-08-03 18:16:36
- Vektor
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H