All CVEs — page 515 of 631
The complete archive, 25 per page, newest first. 15775 records. Search instead.
The flaw in the WP Recipe Maker plugin allows unauthenticated users to write unlimited data into any user's metadata, potentially preventing account access, including for administrators.
This flaw allows users with the Subscriber role and above to obtain a valid identity assertion for another user, including administrators, and authenticate as them, due to the plugin not binding the OpenID Connect identity assertion to the correct authorization grant.