Threats tagged 'ghsa-655w-h872-387j'

The Events Made Easy WordPress plugin before version 3.1.2 contains an authorization bypass vulnerability. This flaw allows unauthenticated attackers to manipulate payment authorization tokens, enabling them to pay a lower amount for a cheap booking while marking a separate, higher-priced booking as fully paid. The vulnerability is classified as CWE-639, indicating improper authorization through user-controlled keys. The issue has a medium severity with a CVSS score of 5.3.