Yasin

**Name of the Vulnerable Software and Affected Versions** WordPress Hybrid Composer version 1.4.6 **Description** An unauthenticated settings change issue allows attackers to modify WordPress options by exploiting the `hc ajax save option` action. By sending POST requests to the 'admin-ajax.php' endpoint with the `action` parameter set to `hc ajax save option`, an attacker can enable user registration and set the default role to administrator, leading to account takeover. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.