Threats tagged 'ghsa-x4q5-jc3v-xwpf'

The Komfortkasse for WooCommerce WordPress plugin versions prior to 1.4.9 improperly validate REST API request authenticity by overriding WordPress's nonce verification. This flaw allows a request forged in a logged-in administrator's browser to be accepted, enabling an attacker to create a new administrator account and fully take over the site.