Threats tagged 'ghsa-qg92-c692-242m'

The Mail Debug for WooCommerce WordPress plugin up to version 1.3.0 lacks proper capability, authentication, and nonce checks on an email-logging action. This flaw allows unauthenticated users to access the full body of all emails sent by the site, including sensitive password-reset emails. Exploiting this vulnerability could enable an attacker to obtain reset keys and take over administrator accounts.