Threats tagged 'ghsa-g634-mqw6-9p22'

The TrueBooker – Appointment Booking and Scheduler System WordPress plugin up to version 1.2.3 contains a critical vulnerability in its password recovery mechanism. The plugin does not properly validate user identity during password reset requests, allowing unauthenticated attackers to reset passwords of arbitrary accounts, including administrators. This flaw enables account takeover with full confidentiality, integrity, and availability impact.