Threats tagged 'ghsa-9mf8-fwp6-wv6x'

The Mstoreapp Mobile App WordPress plugin through version 2.08 and Mstoreapp Mobile Multivendor through version 9.0.1 contain a vulnerability where user identity is not properly verified during an AJAX action. This flaw allows unauthenticated attackers to retrieve valid sessions for arbitrary users if they know the users' email addresses. The vulnerability has a critical severity rating with a CVSS score of 9.8.