Threats tagged 'ghsa-8pgw-crm2-c68x'

The RegistrationMagic WordPress plugin versions before 6.1.0.4 have a vulnerability where the plugin does not verify ownership of the submitted email address before updating the associated WordPress user account. This flaw allows unauthenticated attackers to overwrite profile fields of arbitrary non-administrator users by submitting a public form with manipulated name and primary-email fields.