Threats tagged 'ghsa-fh8h-gqm4-44gg'

The AutomatorWP WordPress plugin versions before 6.0.8 contain a vulnerability where requests completing Zoom and AWeber integration connections are not bound to the initiating administrator. This allows a logged-in administrator to be tricked via a CSRF attack into replacing stored integration credentials with those controlled by an attacker, redirecting data sent to these services. Exploitation requires the integration to be already connected and knowledge of the site's OAuth client identifier.