WaMate Confirm <= 2.0.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Phone Number Blocking/Unblocking
mediumThe WaMate Confirm – Order Confirmation plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 2.0.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access...
- CVSS:
- 5.3
- Affected:
- up to 2.0.2
- Fixed in:
- 2.0.3
- Disclosed:
- Feb 10, 2026