Threats tagged 'ghsa-3fmm-mc8g-m4mq'

The Mine CloudVod WordPress plugin versions before 2.6.6 have a vulnerability where the plugin does not verify that an order belongs to the requesting user before disclosing its payment status. This flaw allows any authenticated user, including those with subscriber-level access, to view other customers' order statuses, purchased items, and, during an Alipay payment process, the buyer's Alipay account identifier.