CVE-2026-15248

Affected software: Meta Box WordPress plugin (WordPress) prior to 5.13.1. Vulnerability: does not verify that the user is authorized to delete the supplied attachment, enabling a low-privilege user (e.g., Contributor) to permanently delete arbitrary media attachments owned by other users. Root ca...

CVE-2026-14938

CVE-2026-14938 affects the FluentBoards WordPress plugin prior to 1.95.3. The issue: during a board import, the plugin does not verify that selected items belong to a board the requesting user is authorized to access, allowing any authenticated user with member access on a single board to copy/re...

CVE-2026-67310

OpenRemote org.openremote:openremote versions = 1.26.2 contain an insecure direct object reference vulnerability in the setAssetLinks endpoint of AlarmResourceImpl. The realm access check validates only a single realm obtained via realms.stream.findFirst on a HashSet of realms from the request,...

CVE-2025-14073

The WooCommerce PayPal Payments plugin for WordPress is vulnerable to Sensitive Information Disclosure due to an Insecure Direct Object Reference in all versions up to, and including, 3.3.2 via the enqueuepaypalinsightsscriptonorderreceived function due to missing validation on a user controlled...

EUVD-2025-210580

The WooCommerce PayPal Payments plugin for WordPress is vulnerable to Sensitive Information Disclosure due to an Insecure Direct Object Reference in all versions up to, and including, 3.3.2 via the enqueuepaypalinsightsscriptonorderreceived function due to missing validation on a user controlled...

CVE-2026-17567 Fluent Forms <= 6.2.8 - Unauthenticated Sensitive Information Exposure via Insecure Direct Object Reference and Weak Transaction Hash in 'transaction' Parameter

The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.2.8 via the 'transaction' parameter due to missing validation on a user controlled key. This...

EUVD-2026-51517

The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.2.8 via the 'transaction' parameter due to missing validation on a user controlled key. This...

CVE-2026-15209

The CVE-2026-15209 entry concerns the JS Help Desk WordPress plugin (before version 3.1.5). The affected component handles tickets without verifying that the requesting user owns the ticket being loaded, enabling a low-privileged authenticated user to supply another user’s ticket ID and read that...

CVE-2026-14929

The CVE-2026-14929 entry concerns the JS Help Desk WordPress plugin, affected versions before 3.1.4. The vulnerability is an IDOR where the plugin does not verify ownership of the targeted reply before updating it, allowing any authenticated user (Subscriber or higher) to overwrite the content of...

CVE-2026-14843

The CVE concerns the WordPress plugin Events Made Easy prior to version 3.1.4 . The vulnerability arises because the plugin does not verify that the requester is authorized to modify a targeted record during an unauthenticated data-change request; it relies on a public nonce with no per-record to...

CVE-2026-14847

The vulnerability CVE-2026-14847 affects the Paid Membership Subscriptions WordPress plugin prior to version 3.0.7. One of the plugin’s payment-related AJAX actions does not perform capability checks or nonce validation, allowing any authenticated user with Subscriber-level access or higher to di...

CVE-2026-14847 Paid Member Subscriptions < 3.0.7 - Subscriber+ Payment Data Disclosure via IDOR

The Paid Membership Subscriptions WordPress plugin before 3.0.7 does not perform capability or nonce checks on one of its payment-related AJAX actions, allowing any authenticated user with Subscriber-level access and above to disclose the payment details of any member by enumerating the payment...

PT-2026-66743

Name of the Vulnerable Software and Affected Versions Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder versions prior to 6.2.9 Description An Insecure Direct Object Reference exists due to missing validation on a user-controlled key. Unauthenticated attackers...

CVE-2026-68501 Sylius Mollie Plugin: Unauthenticated IDOR leaks order token and customer PII

Sylius Mollie Plugin provides Mollie payment integration for Sylius applications. Prior to 2.2.8, 3.2.4, and 3.3.1, Sylius Mollie Plugin's GET /locale/thank-you PageRedirectController::thankYouAction and GET /locale/get-code QrCodeAction::fetchQrCodeFromOrder endpoints look up sequential orderId...

CVE-2026-67348 Julep Insecure Direct Object Reference via GET /executions/{execution_id}

Julep contains an insecure direct object reference vulnerability in the getexecutiondetails endpoint that allows authenticated tenants to read another tenant's execution data. Attackers can supply arbitrary executionid values to retrieve sensitive execution records including task inputs, outputs,...

CVE-2026-13145 WP Travel < 11.8.1 - Subscriber+ Booking PII Disclosure via IDOR

The WP Travel WordPress plugin before 11.8.1 does not verify that the booking requested on its customer account dashboard belongs to the current user, allowing any logged-in user to read another customer's booking details, including billing address information, by supplying an arbitrary booking...

CVE-2026-15255

CVE-2026-15255 affects the RegistrationMagic WordPress plugin prior to 6.0.9.4. The issue arises from improper validation of a one-time password in a cookie, enabling unauthenticated attackers to read other users’ form submission data (including personal information). Affected versions are

CVE-2025-60931

An Insecure Direct Object Reference IDOR in the Employee Compensation View function of Infor Global HR v11.24.10.01.33 allows unauthorized attackers to arbitrarily view the compensation information of other employees via a crafted GET request...

CVE-2026-5060 MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.7.14 - Insecure Direct Object Reference to Authenticated (Instructor+) Arbitrary Attachment Deletion

The MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.7.14. This is due to the stmlmsdeletecover function lacking ownership validation on the fileid parameter before...

CVE-2026-63241

An insecure direct object reference vulnerability in Koollab LMS allowed an authenticated user to query the course completion progress of any other user without authorisation, disclosing private learning progress information...