Threats affecting pkg:github/wondercms

WonderCMS versions prior to 3.7.0 have a vulnerability in the saveAction functionality that allows an authenticated user to change the administrator password without needing to re-authenticate. This flaw enables attackers with some level of access to bypass re-verification controls during password changes, potentially maintaining or escalating unauthorized administrative access. The issue is fixed in version 3.7.0.