CVE-2026-91050

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference / Missing Authorization in versions up to, and including, 5.7.2. This is due to the publicly reachable stepsstart and stepsloadstep routes...

EUVD-2026-96085

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference / Missing Authorization in versions up to, and including, 5.7.2. This is due to the publicly reachable stepsstart and stepsloadstep routes...

CVE-2026-91050

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress is vulnerable to an Insecure Direct Object Reference (IDOR) in versions up to and including 5.7.2 . The vulnerability exists in the publicly reachable steps__start and steps__load_step routes, which accept a params[p...

CVE-2026-104898

The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 28.4 via the 'id, wpuserid' parameter due to missing validation on a user controlled key. This makes it possible for...

EUVD-2026-96035

The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 28.4 via the 'id, wpuserid' parameter due to missing validation on a user controlled key. This makes it possible for...

CVE-2026-104898 Online Scheduling and Appointment Booking System <= 28.4 - Insecure Direct Object Reference to Authenticated (Subscriber+) Privilege Escalation via 'id' and 'wp_user_id' Parameters via Query String / JSON Body

The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 28.4 via the 'id, wpuserid' parameter due to missing validation on a user controlled key. This makes it possible for...

WordPress WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels plugin <= 5.0.2 - Insecure Direct Object Reference to Unauthenticated Unauthorized Order Document Access vulnerability

Insecure Direct Object Reference to Unauthenticated Unauthorized Order Document Access vulnerability discovered by Brian Mungai in WordPress Plugin WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels versions = 5.0.2...

WordPress Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin <= 5.7.2 - Insecure Direct Object Reference to Authenticated (Subscriber+) Unauthorized Booking Creation and Sensitive Information Disclosure vulnerability

Insecure Direct Object Reference to Authenticated Subscriber+ Unauthorized Booking Creation and Sensitive Information Disclosure vulnerability discovered by Supakiad S. m3ez in WordPress Plugin LatePoint versions = 5.7.2...

WordPress Online Scheduling and Appointment Booking System – Bookly plugin <= 28.4 - Insecure Direct Object Reference to Authenticated (Subscriber+) Privilege Escalation vulnerability

Insecure Direct Object Reference to Authenticated Subscriber+ Privilege Escalation vulnerability discovered by Wordfence PRISM in WordPress Plugin Bookly versions = 28.4...

CVE-2026-93399

CVE-2026-93399 — Bookly IDOR order token disclosure & booking rollback Python 3 PoC for CVE-2026-93399 in Bookly bookly-responsive-appointment-booking-tool. Description PoCbit / GitHub CVE-2026-93399 — Bookly ≤ 28.2 suffers from Insecure Direct Object Reference CWE-639 on public booking AJAX:...

CVE-2026-105833

EspoCRM before 10.0.5 contains an insecure direct object reference vulnerability in PersonalAccount\Service that allows users with Email Account scope access to retrieve other users' IMAP passwords. Attackers who know a victim's Email Account record ID can request that record to steal stored IMAP...

EUVD-2026-95020

EspoCRM before 10.0.5 contains an insecure direct object reference vulnerability in PersonalAccount\Service that allows users with Email Account scope access to retrieve other users' IMAP passwords. Attackers who know a victim's Email Account record ID can request that record to steal stored IMAP...

EUVD-2026-94652

The LatePoint - Appointment Booking & Reservation plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 5.6.9. This is due to the processstepcustomer function using isuserloggedin as the sole gate before merging POSTed customer data into an...

CVE-2026-17538

The LatePoint - Appointment Booking & Reservation plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 5.6.9. This is due to the processstepcustomer function using isuserloggedin as the sole gate before merging POSTed customer data into an...

CVE-2026-17538 Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress <= 5.6.9 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Customer PII Modification

The LatePoint - Appointment Booking & Reservation plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 5.6.9. This is due to the processstepcustomer function using isuserloggedin as the sole gate before merging POSTed customer data into an...

CVE-2026-107270

Gophish versions through 0.12.1 are vulnerable to an Insecure Direct Object Reference (IDOR) (CWE-639) vulnerability. This flaw allows authenticated users to perform an object takeover by supplying sequential IDs in POST requests to the /api/groups/, /api/templates/, /api/pages/, and /api/smtp/ e...

CVE-2026-107270: Authorization Bypass Through User-Controlled Key

Gophish through 0.12.1 contains an insecure direct object reference vulnerability that allows authenticated users to take over other users' groups, templates, landing pages and sending profiles. Attackers can supply another user's sequential id in POST requests to /api/groups/, /api/templates/,...

PT-2026-107719

Name of the Vulnerable Software and Affected Versions LatePoint - Appointment Booking & Reservation plugin for WordPress versions prior to 5.7.0 Description An Insecure Direct Object Reference exists because the process step customer function relies solely on is user logged in to validate request...

CVE-2026-11399

The Helpdesk Support Ticket System for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.1.6 via the 'id' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with...

EUVD-2026-91917

The Helpdesk Support Ticket System for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.1.6 via the 'id' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with...