Threats tagged 'ghsa-5gw3-gf5c-2x2p'

The Amelia WordPress plugin versions up to and including 9.9.1 have a vulnerability that allows unauthorized access to attendee data. This is due to a missing authorization check in the GetEventAttendeesCommandHandler::handle() function, which only verifies a broad capability that lower-privileged roles possess. As a result, authenticated users with wpamelia-customer-level access or higher can export sensitive attendee information for any event by supplying an arbitrary event ID to the relevant endpoint.