Threats tagged 'ghsa-mmxp-wx6x-2jp9'

The Premium Packages WordPress plugin versions before 7.3.1 contain a vulnerability where the plugin does not verify that a user claiming a guest order is the original buyer. This flaw allows any authenticated user to take ownership of any unclaimed guest order by supplying only the order identifier, enabling them to access the buyer's billing details and download purchased files.