Threats tagged 'ghsa-c79g-76jm-qrx5'

The Germanized for WooCommerce plugin for WordPress versions up to 4.1.4 contains a vulnerability that allows authenticated users with Subscriber-level access or higher to access private customer data. This occurs due to improper handling of activation tokens when the "Disable login for unactivated customers" setting is set to No, which is a non-default configuration. Attackers can change their account email to a victim's billing email and redeem an original activation token to link guest orders to their account, exposing sensitive billing information. Exploitation requires public customer registration, double opt-in enabled, and token redemption within one day.