Threats tagged 'ghsa-xhjc-3h89-4qhf'

The New User Approve WordPress plugin versions up to and including 3.0.9 have a vulnerability that allows unauthorized data disclosure. This occurs due to insufficient validation of the API key in the Zapier REST API endpoints, where a loose equality comparison enables unauthenticated attackers to exploit PHP type juggling. Attackers can retrieve personally identifiable information such as usernames and email addresses of users with various approval statuses if the Zapier API key is not configured.