Threats tagged 'ghsa-r545-v5rq-j469'

The MDJM Event Management and Mobile Events Manager WordPress plugins up to version 1.7.8.7 contain a vulnerability where they do not verify ownership or capability on the identifier used in client profile updates. This flaw allows any authenticated user, including low-privileged subscribers, to change the password and email address of any other user account, including administrators, leading to full account takeover.