Threats tagged 'ghsa-g6c9-6jpv-h859'

The Membership Plugin WordPress plugin versions before 4.0.6 contains a vulnerability where it does not verify that the membership referenced in a saved-card payment request belongs to the user making the request. This flaw allows subscriber-level members to access another member's Stripe payment client secret and attach a payment method of their choice to that member's pending payment.