Threats tagged 'ghsa-8w3v-fw7p-fr8m'

The Eventin WordPress plugin (up to version 4.1.29) has a vulnerability that allows authenticated users with subscriber-level access or higher to access sensitive information. By manipulating the 'id' parameter in a query string, an attacker can retrieve email addresses and phone numbers of any WordPress user, including administrators.