Threats tagged 'ghsa-wxpj-24h4-8v79'

The Content Egg plugin for WordPress versions before 12.1.0 has a broken access control vulnerability. This flaw allows unauthenticated attackers to access product data from unpublished posts by exploiting a REST API endpoint that improperly permits access without a valid nonce. Attackers can retrieve sensitive product information such as titles, affiliate URLs, merchant details, and descriptions from draft, pending, scheduled, or private posts.