Threats tagged 'ghsa-xvpx-j2j6-gqv3'

The WP Data Access – App Builder plugin for WordPress has a vulnerability in all versions up to 5.5.88 that allows unauthenticated attackers to extract sensitive information via the 'rel_tab' parameter. This includes database rows such as WordPress user password hashes, email addresses, and password-reset keys. Exploitation requires that an administrator has published at least one app with REST API authorization set to 'anonymous', which is the default for publicly embedded apps.