Cross-account address modification via missing capability check

Improper access control in Aguila Technologies WP Customer Area before 8.2.1 allows remote authenticated users to alter other users' addresses. The cuar_save_address_for_owner AJAX action accepts an attacker-selected owner identifier and address fields while validating a nonce from the attacker's own address form, but does not enforce capability for the target owner. Subscriber-level access is required, and successful exploitation changes another account's stored address data without exposing or deleting it.