Threats tagged 'ghsa-gv8j-xg52-fqpf'

The Royal Addons for Elementor WordPress plugin versions before 1.7.1070 contain a vulnerability where the email delivery configuration for contact forms is stored in a site-global namespace keyed by a non-secret identifier. This allows users with the Author role or higher to overwrite another user's form email configuration, potentially redirecting form submissions to an attacker-controlled email address.