Threats tagged 'ghsa-x8r8-2rh2-5h4p'

The Essential Real Estate WordPress plugin versions before 5.3.5 contains a vulnerability where it does not verify ownership of an invoice before rendering it via an AJAX action. This flaw allows an authenticated user with low privileges to access invoices belonging to other users, exposing sensitive information such as the invoice owner's name, account email address, and financial details.