Threats tagged 'ghsa-4pg8-54r5-7m9g'

The WPCOM Member WordPress plugin versions before 1.8.3 have a vulnerability in the WeChat login code verification process. The plugin does not limit or bind attempts to verify WeChat login codes, which allows unauthenticated attackers to brute-force login codes issued to other users. Successful exploitation can lead to attackers logging in as those users, including administrators, if WeChat official-account keyword login is enabled.