Threats tagged 'ghsa-j3xg-qwqj-hq74'

The Wild Apricot Login plugin for WordPress up to version 1.0.18 has an authentication bypass vulnerability via SSO email-collision account binding. Attackers controlling a Wild Apricot contact with the same email as a WordPress administrator can authenticate as that admin without proof of account ownership. This allows obtaining a valid network-wide authentication cookie on WordPress Multisite networks, granting administrator access across subsites.