Threats tagged 'ghsa-w5f6-5hgr-5mp9'

The WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible plugin for WordPress contains an Insecure Direct Object Reference (IDOR) vulnerability in all versions up to and including 6.7.25. This flaw exists due to missing validation on the 'customerid' parameter in the 'wcfm_delete_wcfm_customer' function. Authenticated users with Vendor-level access or higher can exploit this to delete arbitrary users, including administrators.