Access violation vulnerability in Download Manager and Payment Form WordPress Plugin – WP SmartPay 2.7.13

A WordPress plugin called WP SmartPay has a security issue that allows attackers to gain access to user accounts. This is because the plugin does not properly check a user’s identity before allowing them to change their email. This means that attackers who have at least Subscriber-level access can change anyone’s email, including administrators, and use this to reset the password and take over the account.