Threats tagged 'ghsa-6fcx-4fmq-2fx7'

The wModes plugin for WordPress versions up to and including 1.2.2 has an authorization bypass vulnerability. This flaw allows authenticated users with subscriber-level access or higher to access sensitive information through an improperly secured AJAX endpoint. The exposed data includes user emails, usernames, roles, capabilities, and WooCommerce-related information such as products and payment methods. The vulnerability has a medium severity rating with a CVSS score of 4.3.