Threats tagged 'ghsa-5x4q-vfvg-wp36'

The Premium Packages WordPress plugin versions prior to 7.3.1 contain a vulnerability where the plugin does not verify ownership or session binding when loading a previously saved shopping cart. This flaw allows any unauthenticated user who obtains another shopper's saved-cart identifier to access that shopper's cart contents, including selected products, quantities, and buyer-entered custom field data, by loading them into their own session.