Threats tagged 'ghsa-ggh8-f4wg-vh5g'

The A2Reviews WordPress plugin up to version 1.2.3 has an authorization flaw in several API command handlers. This flaw allows unauthenticated attackers to modify plugin settings and product review metadata, as well as read non-public product metadata. The issue arises because the plugin relies on a signature keyed on a value that is empty by default on unconnected installs, leading to improper authorization verification.