Threats tagged 'ghsa-rmmm-8g4j-3qgc'

The Appointment Booking Plugin – LatePoint for WordPress versions up to and including 5.7.6 is vulnerable to an authentication bypass via account takeover. This vulnerability arises from improper handling of SQL query conditions in the plugin's code, allowing unauthenticated attackers to reset passwords of arbitrary customers and gain full access to their bookings, orders, and personal information. When a specific plugin option is enabled, attackers can also take over linked WordPress user accounts.