CVE-2019-25738

Name of the Vulnerable Software and Affected Versions WordPress Hybrid Composer version 1.4.6

Description An unauthenticated settings change issue allows attackers to modify WordPress options by exploiting the hc ajax save option action. By sending POST requests to the 'admin-ajax.php' endpoint with the action parameter set to hc ajax save option, an attacker can enable user registration and set the default role to administrator, leading to account takeover.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.