WordPress Plugin: houzez-login-register: CVE-2024-21743: Authorization Bypass Through User-Controlled Key

The Houzez Login Register plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.2.5. This is due to the houzez_agency_agent_update function not properly verifying a user's identity prior to allowing them to update user details like email address. This makes it possible for authenticated attackers, with subscriber-level access and above, to change any user's email, including administrators and reset the password therefore gaining access to the account.