Threats tagged 'ghsa-gpq2-qwv8-rj79'

The AutomatorWP WordPress plugin versions before 6.0.7 contain a vulnerability where it does not verify that the user completing Zoom and AWeber integration connections is authorized. This flaw allows unauthenticated attackers to replace stored integration credentials with their own, redirecting data sent to these services into accounts they control. Exploitation requires the integration to be already connected and knowledge of the site's OAuth client identifier.