Houzez Login Register <= 3.2.5 - Authenticated (Subscriber+) Privilege Escalation via Account Takeover

The Houzez Login Register plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.2.5. This is due to the houzez_agency_agent_update function not properly verifying a user's identity prior to allowing them to update user details like email address. This makes it possible for authenticated attackers, with subscriber-level access and above, to change any user's email, including administrators and reset the password therefore gaining access to the account.