Threats tagged 'ghsa-93w9-c7qv-9m7x'

The Advanced Appointment Booking & Scheduling WordPress plugin versions before 2.7 contain a vulnerability where the plugin does not check the site's user-registration setting before allowing account creation via a publicly accessible shortcode. This flaw enables unauthenticated attackers to register arbitrary user accounts and be automatically logged in, even if user registration is disabled on the site.