Threats tagged 'ghsa-874x-phmj-hrr8'

The Magic Link WordPress plugin versions before 2.2.6 contains a vulnerability where it does not verify if a user requesting a login link is authorized to generate one for the targeted account. This flaw allows any authenticated user, including low-privilege roles such as subscribers, to generate a valid login link for an administrator account and gain unauthorized access.