Threats tagged 'ghsa-42fg-gx44-hcxv'

The SiteSEO – SEO Simplified plugin for WordPress versions up to and including 1.3.2 contains an improper authorization vulnerability. This flaw allows authenticated users with the siteseo_manage capability, such as Author-level users granted SiteSEO access, to read arbitrary post metadata they should not have access to. In WooCommerce setups, this can expose sensitive customer billing details including names, emails, phone numbers, addresses, and payment methods.