Fashion rental company HURR Collective exposed user information through misconfigured plugin