Access violation vulnerability in Houzez Login Register 3.2.5

The Houzez Login Register plugin for WordPress has a security flaw in all versions up to 3.2.5. This means that the houzez_agency_agent_update function does not properly check a user’s identity before allowing them to update their email address. This vulnerability can be exploited by authenticated attackers who have at least subscriber-level access. They can change the email address of any user, even administrators, and reset their password, giving them access to the account.