Threats tagged 'ghsa-594q-h3jv-fr98'

The Membership Plugin WordPress plugin versions before 4.0.6 lack authorization and CSRF protections on a database maintenance routine. This flaw allows unauthenticated users to alter the plugin's database tables by converting them to a narrower character set, which irreversibly replaces all 4-byte characters such as emoji and certain CJK characters with question marks in membership level, discount code, and payment records.