All CVEs — page 738 of 854
The complete archive, 25 per page, newest first. 21350 records. Search instead.
The flaw in the WP Recipe Maker plugin allows unauthenticated users to write unlimited data into any user's metadata, potentially preventing account access, including for administrators.
This flaw allows users with the Subscriber role and above to obtain a valid identity assertion for another user, including administrators, and authenticate as them, due to the plugin not binding the OpenID Connect identity assertion to the correct authorization grant.