Description
A user changing their email after signing up and verifying it can change it without verification in profile settings. The configuration option "verify_email_enabled" will only validate email only on sign up.
Remediation
References
Related Vulnerabilities
WordPress Plugin Premmerce Product Filter for WooCommerce Security Bypass (3.1.2)
MySQL Other Vulnerability (CVE-2000-0045)
WordPress Plugin WordLift-AI powered SEO-Schema Cross-Site Scripting (3.37.1)
WordPress Plugin RSS Includes Pages Unspecified Vulnerability (3.1)
Artifactory Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2019-10321)