Loading vulnerability details…
CVSS v3.1
6.5
EPSS
0.48%
Published
Jan 16, 2024
Modified
Jun 11, 2025
Public PoC / Exploit (1)
All weaponized →Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.
Description
The WP Customer Area WordPress plugin before 8.2.1 does not properly validates user capabilities in some of its AJAX actions, allowing any users to retrieve other user's account address.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NWeaknesses (CWE)
Affected Products (1)
References (2)