CVE-2026-10820

The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content WordPress plugin (versions prior to 4.16.17 ) is vulnerable to an Insecure Direct Object Reference (IDOR) . The software fails to verify if the authenticated user performing a subscription a...

CVE-2026-10820

The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content WordPress plugin before 4.16.17 does not verify that the user performing a subscription action owns the targeted subscription, allowing any authenticated user Subscriber+ to cancel other...

PT-2026-53052

Name of the Vulnerable Software and Affected Versions Dokan: AI Powered WooCommerce Multivendor Marketplace Solution versions prior to 5.0.5 Description An Insecure Direct Object Reference exists due to missing validation on a user-controlled key. Authenticated attackers with subscriber-level...

CVE-2026-10820: Undefined Security Weakness

The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content WordPress plugin before 4.16.17 does not verify that the user performing a subscription action owns the targeted subscription, allowing any authenticated user Subscriber+ to cancel other...

PT-2026-53044

Name of the Vulnerable Software and Affected Versions Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content versions prior to 4.16.17 Description An Insecure Direct Object Reference occurs because the software fails to verify if the authenticated...

WordPress Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy plugin <= 5.0.4 - Authenticated (Subscriber+) Insecure Direct Object Reference to Information Disclosure vulnerability

Authenticated Subscriber+ Insecure Direct Object Reference to Information Disclosure vulnerability discovered by 0xHerc - IntegSec in WordPress Plugin Dokan versions = 5.0.4...

CVE-2026-56069

Unauthenticated Insecure Direct Object References IDOR in Toolset Forms = 2.6.24 versions...

CVE-2026-57652 WordPress JS Help Desk plugin <= 3.1.0 - Insecure Direct Object References (IDOR) vulnerability

Unauthenticated Insecure Direct Object References IDOR in JS Help Desk = 3.1.0 versions...

CVE-2026-57646 WordPress Majestic Support plugin <= 1.1.7 - Insecure Direct Object References (IDOR) vulnerability

Subscriber Insecure Direct Object References IDOR in Majestic Support = 1.1.7 versions...

CVE-2026-57646 WordPress Majestic Support plugin <= 1.1.7 - Insecure Direct Object References (IDOR) vulnerability

Subscriber Insecure Direct Object References IDOR in Majestic Support = 1.1.7 versions...

CVE-2026-57630 WordPress Blocksy Companion Pro plugin <= 2.1.46 - Insecure Direct Object References (IDOR) vulnerability

Unauthenticated Insecure Direct Object References IDOR in Blocksy Companion Pro = 2.1.46 versions...

CVE-2026-56069 WordPress Toolset Forms plugin <= 2.6.24 - Insecure Direct Object References (IDOR) vulnerability

Unauthenticated Insecure Direct Object References IDOR in Toolset Forms = 2.6.24 versions...

CVE-2026-56048 WordPress Payment Gateway Based Fees and Discounts for WooCommerce plugin <= 3.0.0 - Insecure Direct Object References (IDOR) vulnerability

Unauthenticated Insecure Direct Object References IDOR in Payment Gateway Based Fees and Discounts for WooCommerce = 3.0.0 versions...

CVE-2026-54826 WordPress SupportCandy plugin <= 3.4.6 - Insecure Direct Object References (IDOR) vulnerability

Subscriber Insecure Direct Object References IDOR in SupportCandy = 3.4.6 versions...

CVE-2026-54826

CVE-2026-54826 affects the WordPress SupportCandy plugin up to version 3.4.6, with an Insecure Direct Object References (IDOR) vulnerability. Root cause: insecure direct object references allowing unauthorized access to objects. Impact: CVSS 3.1 base score 7.6 (High)—confidentiality impact High, ...

CVE-2026-54826 WordPress SupportCandy plugin <= 3.4.6 - Insecure Direct Object References (IDOR) vulnerability

Subscriber Insecure Direct Object References IDOR in SupportCandy = 3.4.6 versions...

PT-2026-52835

Unauthenticated Insecure Direct Object References IDOR in GravityView = 3.0.0 versions...

GO-2026-5302 ShellHub has cross-tenant IDOR in `GET /api/sessions/:uid` that discloses SSH session data in github.com/shellhub-io/shellhub

ShellHub has cross-tenant IDOR in GET /api/sessions/:uid that discloses SSH session data in github.com/shellhub-io/shellhub...

CVE-2026-56772

NewsBlur

CVE-2026-56772 NewsBlur < 14.5.0 - Insecure Direct Object Reference in Social Interactions Endpoint

NewsBlur before 14.5.0 contains a broken access control vulnerability that allows authenticated users to read private notification feeds by supplying arbitrary userid values to the GET /social/interactions endpoint without ownership verification. Attackers can enumerate userid values to access...