Threats tagged 'ghsa-qmx7-75c2-8553'

ShopSmart Loyalty for WooCommerce plugin versions through 1.0.0 allow unauthorized access to customer loyalty profiles via a phone-number lookup feature. This occurs because the plugin does not verify authorization or ownership before returning customer data. As a result, anyone knowing a customer's phone number can retrieve sensitive information including name, email, and account balance.