Softmarket Digital Marketplace
Monthly
Authentication bypass in the SoftMarket - Digital Marketplace WordPress plugin (versions through 1.0.0) lets remote unauthenticated attackers impersonate any verified user by supplying only that user's numeric ID to a flawed branch of the email-verification flow, resulting in full account takeover. Publicly available exploit code exists (published by WPScan), and the CVSS 3.1 score of 9.1 reflects high confidentiality and integrity impact with no privileges or user interaction required. Despite the critical rating, the EPSS probability is low (0.19%, 9th percentile) and there is no evidence of active exploitation.
Authentication bypass in the SoftMarket - Digital Marketplace WordPress plugin (versions through 1.0.0) lets remote unauthenticated attackers impersonate any verified user by supplying only that user's numeric ID to a flawed branch of the email-verification flow, resulting in full account takeover. Publicly available exploit code exists (published by WPScan), and the CVSS 3.1 score of 9.1 reflects high confidentiality and integrity impact with no privileges or user interaction required. Despite the critical rating, the EPSS probability is low (0.19%, 9th percentile) and there is no evidence of active exploitation.