Threats tagged 'ghsa-8cr7-x3xr-ppw5'

The Rox Appointment Booking plugin for WordPress up to version 1.3.1 contains a privilege escalation vulnerability via mass assignment. An unauthenticated attacker can exploit a public REST endpoint to inject an arbitrary WordPress user ID into a customer record. When an administrator later edits and saves this record, the attacker's supplied user ID and email are used to update the administrator's account, enabling account takeover through password reset. Exploitation requires the attacker to know or guess a valid administrator user ID and for an administrator to interact with the poisoned record.