title: WP Customer Area < 8.2.1 - Subscriber+ Account Address Leak
description: The WP Customer Area WordPress plugin before 8.2.1 does not properly validates user capabilities in some of its AJAX actions, allowing any users to retrieve other user's account address.
problem types: CWE-639 Authorization Bypass Through User-Controlled Key
affected:
{
vendor: Unknown
product: WP Customer Area
versions:
status: affected, versionType: semver, version: 0, lessThan: 8.2.1
defaultStatus: unaffected
collectionURL: https://wordpress.org/plugins
}