The WholesaleX WordPress plugin before 3.0.9 does not protect or remove the user-import file it keeps in a publicly accessible location under a predictable name, allowing unauthenticated users to download the most recently imported user data, including any account passwords and customer contact and address details it contains. This vulnerability allows unauthorized access to sensitive information, potenti [truncated]
The WholesaleX WordPress plugin before 3.0.9 does not check that a stored account confirmation code is set before comparing it with the one supplied in a request. This allows unauthenticated users to activate pending accounts and bypass the administrator approval required before login. Defenders should assess exposure and prioritize verification and remediation to prevent potential unauthorized access and [truncated]
