PT-2026-1127

Name of the Vulnerable Software and Affected Versions Bagisto versions prior to 2.3.10 Description An Insecure Direct Object Reference issue exists in the customer order reorder function. This allows authenticated customers to add items from another customer's order to their own shopping cart by...

WordPress Curly theme <= 3.3 - Insecure Direct Object References (IDOR) vulnerability

Insecure Direct Object References IDOR vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme Curly versions = 3.3...

CVE-2025-49352

Technical details for CVE-2025-49352 are not publicly provided in the supplied documents. No confirmed affected product, root cause, impact, or fix is available here. Monitor for official updates from CVE/NVD feeds and vendor advisories.

CVE-2025-49334 WordPress MyD Delivery plugin <= 1.7.1 - Insecure Direct Object References (IDOR) vulnerability

Authorization Bypass Through User-Controlled Key vulnerability in Eduardo Villão MyD Delivery myd-delivery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MyD Delivery: from n/a through = 1.7.1...

CVE-2025-49334 WordPress MyD Delivery plugin <= 1.3.7 - Insecure Direct Object References (IDOR) vulnerability

Authorization Bypass Through User-Controlled Key vulnerability in Eduardo Villão MyD Delivery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MyD Delivery: from n/a through 1.3.7...

WordPress Master Addons for Elementor plugin <= 2.0.9.9.4 - Insecure Direct Object References (IDOR) vulnerability

Insecure Direct Object References IDOR vulnerability discovered by Mdr in WordPress Plugin Master Addons for Elementor versions = 2.0.9.9.4...

WordPress WordPress Simple PayPal Shopping Cart plugin <= 5.1.3 - Insecure Direct Object Reference via 'quantity' vulnerability

Insecure Direct Object Reference via 'quantity' vulnerability discovered by Jack Taylor in WordPress Plugin Simple Shopping Cart versions = 5.1.3...

WordPress WPBookit plugin <= 1.0.2 - Insecure Direct Object Reference to Unauthenticated Privilege Escalation via Email Update vulnerability

Insecure Direct Object Reference to Unauthenticated Privilege Escalation via Email Update vulnerability discovered by kr0d in WordPress Plugin WPBookit versions = 1.0.2...

WordPress WP Job Portal plugin <= 2.2.6 - Insecure Direct Object Reference to Authenticated (Employer+) Arbitrary Job Deletion vulnerability

Insecure Direct Object Reference to Authenticated Employer+ Arbitrary Job Deletion vulnerability discovered by thevietronin - GalaxyOne in WordPress Plugin WP Job Portal versions = 2.2.6...

WordPress Return Refund and Exchange For WooCommerce plugin <= 4.5.5 - Insecure Direct Object Reference to Authenticated (Subscriber+) Refund Request Cancellation vulnerability

Insecure Direct Object Reference to Authenticated Subscriber+ Refund Request Cancellation vulnerability discovered by Powpy in WordPress Plugin Return Refund and Exchange For WooCommerce versions = 4.5.5...

CVE-2025-69032

Technical details for CVE-2025-69032 are not provided in the connected documents. The initial description only notes an authorization bypass in Mikado-Themes FiveStar; no affected versions, root cause, impact, or fixes are specified. Monitor for updates.

CVE-2025-69032 WordPress FiveStar theme <= 1.7 - Insecure Direct Object References (IDOR) vulnerability

Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes FiveStar fivestar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FiveStar: from n/a through = 1.7...

CVE-2025-69030

CVE-2025-69030 affects Backpack Traveler (Mikado-Themes) WordPress plugin/theme, with an Authorization Bypass Through User-Controlled Key vulnerability reported for Backpack Traveler variants up to 2.10.3. The Initial Description notes an access-control issue enabling bypass via a user-controlled...

CVE-2025-69030 WordPress Backpack Traveler theme <= 2.10.3 - Insecure Direct Object References (IDOR) vulnerability

Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Backpack Traveler backpacktraveler allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Backpack Traveler: from n/a through = 2.10.3...

CVE-2025-68979

CVE-2025-68979 relates to the Simple Calendar – Google Calendar Plugin (WordPress). The vulnerability is described as an authorization bypass via a user-controlled key that could enable access to Google Calendar events through an unauthenticated path. Wordfence’s vulnerability digest lists CVE-20...

CVE-2025-68979 WordPress Google Calendar Events plugin <= 3.5.9 - Insecure Direct Object References (IDOR) vulnerability

Authorization Bypass Through User-Controlled Key vulnerability in SimpleCalendar Google Calendar Events google-calendar-events allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Google Calendar Events: from n/a through = 3.5.9...

CVE-2025-68975 WordPress Eagle Booking plugin <= 1.3.4.3 - Insecure Direct Object References (IDOR) vulnerability

Authorization Bypass Through User-Controlled Key vulnerability in Eagle-Themes Eagle Booking eagle-booking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Eagle Booking: from n/a through = 1.3.4.3...

WordPress JetPopup plugin <= 2.0.20.1 - Insecure Direct Object References (IDOR) vulnerability

Insecure Direct Object References IDOR vulnerability discovered by Bonds in WordPress Plugin JetPopup versions = 2.0.20.1...

CVE-2025-68502 WordPress JetPopup plugin <= 2.0.20.1 - Insecure Direct Object References (IDOR) vulnerability

Authorization Bypass Through User-Controlled Key vulnerability in Crocoblock JetPopup allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JetPopup: from n/a through 2.0.20.1...

CVE-2025-68502

CVE-2025-68502 affects Crocoblock JetPopup (JetPopup) with versions up to 2.0.20.1. The issue is an Authorization Bypass Through User-Controlled Key, allowing bypass of access controls as described in the initial description. CVSS 3.1 base score 4.3 (MEDIUM); metrics indicate network access, low ...