Threats tagged 'ghsa-qm9j-xm9j-x4x3'

The Essential Real Estate WordPress plugin versions before 5.3.5 contain a vulnerability in an AJAX action that fails to verify whether a listing package selected for free activation is actually free or if the requesting user is authorized. This flaw allows self-registered customers to activate paid packages without payment, causing the site to record paid invoices incorrectly.