CVE-2026-81424 Accept Stripe Payments < 2.1.4 - Unauthenticated Product Substitution via IDOR

The Accept Stripe Payments WordPress plugin before 2.1.4 does not verify that the product fulfilled when a checkout is completed matches the product the authoritative payment was actually made for, checking only that the amount paid is at least the referenced product's price, allowing...

CVE-2026-78150

CVE-2026-78150 affects the Smart Post WordPress plugin (Post Grid, Post Carousel, & List Category Posts – by Smart Post Show), versions 4.0.0 through 4.0.7 . The root cause is an IDOR in the saved-templates-duplicate endpoint, which fails to verify the type, ownership, or status of the post being...

CVE-2026-78150 Post Carousel 4.0.0 - 4.0.7 - Contributor+ Private and Protected Post Content Disclosure via saved-templates-duplicate IDOR

The Smart Post WordPress plugin before 4.0.8 does not check the type, ownership or status of the post it is asked to duplicate, allowing users with contributor privileges and above to copy any private or password protected post into a draft of their own and read its content and metadata...

CVE-2026-78150 Post Carousel 4.0.0 - 4.0.7 - Contributor+ Private and Protected Post Content Disclosure via saved-templates-duplicate IDOR

The Smart Post WordPress plugin before 4.0.8 does not check the type, ownership or status of the post it is asked to duplicate, allowing users with contributor privileges and above to copy any private or password protected post into a draft of their own and read its content and metadata...

CVE-2026-61688

SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1, an authenticated user can view the API request history of any other user's API tokens within the same company by manipulating two writable Symfony UX LiveComponent props on the DataGrid component. Version 3.0.1 fixes the...

CVE-2026-85669

potpie through 2.0.0 fails to verify user ownership on the POST /conversations/conversationid/code-changes/sync endpoint. Authenticated attackers can write arbitrary file changes into other users' conversations by supplying their conversation IDs, allowing unauthorized modification of pending...

CVE-2026-85607

Blinko 1.8.7 contains an authorization bypass IDOR vulnerability in multiple tRPC procedures message.list, message.update, message.delete, message.clearAfter in server/routerTrpc/message.ts and conversation.clearMessages in server/routerTrpc/conversation.ts. Although these procedures require...

EUVD-2026-71125

potpie through 2.0.0 fails to verify user ownership on the POST /conversations/conversationid/code-changes/sync endpoint. Authenticated attackers can write arbitrary file changes into other users' conversations by supplying their conversation IDs, allowing unauthorized modification of pending...

CVE-2026-85607 Blinko 1.8.7 Cross-User AI Conversation Read and Write via message tRPC Router

Blinko 1.8.7 contains an authorization bypass IDOR vulnerability in multiple tRPC procedures message.list, message.update, message.delete, message.clearAfter in server/routerTrpc/message.ts and conversation.clearMessages in server/routerTrpc/conversation.ts. Although these procedures require...

EUVD-2026-71223

Blinko 1.8.7 contains an authorization bypass IDOR vulnerability in multiple tRPC procedures message.list, message.update, message.delete, message.clearAfter in server/routerTrpc/message.ts and conversation.clearMessages in server/routerTrpc/conversation.ts. Although these procedures require...

CVE-2026-85607 Blinko 1.8.7 Cross-User AI Conversation Read and Write via message tRPC Router

Blinko 1.8.7 contains an authorization bypass IDOR vulnerability in multiple tRPC procedures message.list, message.update, message.delete, message.clearAfter in server/routerTrpc/message.ts and conversation.clearMessages in server/routerTrpc/conversation.ts. Although these procedures require...

CVE-2026-85607

Blinko 1.8.7 contains an authorization bypass (IDOR) vulnerability in multiple tRPC procedures (message.list, message.update, message.delete, message.clearAfter in server/routerTrpc/message.ts and conversation.clearMessages in server/routerTrpc/conversation.ts). Although these procedures require ...

CVE-2026-85615 Openpanel before 2.3.0 Cross-Tenant IDOR via report.getLayouts

Openpanel before 2.3.0 contains an insecure direct object reference vulnerability in the report.getLayouts and report.resetLayout tRPC procedures that fail to bind dashboardId to the authorized projectId. Authenticated attackers can supply an arbitrary victim dashboardId with their own projectId ...

CVE-2026-85615

Openpanel before 2.3.0 is affected by an insecure direct object reference (IDOR) vulnerability in the report.getLayouts and report.resetLayout tRPC procedures. The root cause is a failure to bind dashboardId to the authorized projectId , allowing an authenticated attacker to supply an arbitrary v...

CVE-2026-85616 Snipe-IT before 8.6.2 Authorization Bypass via Checkout-Acceptance

Snipe-IT versions before 8.6.2 contain an authorization bypass vulnerability in checkout-acceptance report actions when Full Multiple Company Support is enabled. Authenticated users with reports.view permission can enumerate sequential acceptance IDs and soft-delete or trigger reminder emails for...

CVE-2026-27432

The WP Rentals WordPress theme by sc Internet Vivoo is affected by an Authorization Bypass Through User-Controlled Key vulnerability (classified as an Insecure Direct Object Reference / IDOR ) in versions before 3.16.0 . The flaw allows exploitation of incorrectly configured access control securi...

WordPress WP Rentals theme < 3.16.0 - Insecure Direct Object References (IDOR) vulnerability

Insecure Direct Object References IDOR vulnerability discovered by Rafie Muhammad in WordPress Theme WP Rentals versions 3.16.0...

CVE-2026-16281

The Classified Listing WordPress plugin before 6.1.1 suffers from an IDOR (Insecure Direct Object Reference) in its AI image-editing AJAX action. The plugin fails to verify that the caller owns or can edit the target listing before performing media operations, allowing any authenticated user—incl...

CVE-2026-16281 Classified Listing < 6.1.1 - Subscriber+ Arbitrary Attachment Deletion and Listing Image Tampering via IDOR

The Classified Listing WordPress plugin before 6.1.1 does not verify that the caller owns or can edit the target listing before its AI image-editing AJAX action deletes or attaches media, allowing any authenticated user, including a subscriber, to permanently delete attachments from, and attach...

PT-2026-85540

Blinko 1.8.7 contains an authorization bypass IDOR vulnerability in multiple tRPC procedures message.list, message.update, message.delete, message.clearAfter in server/routerTrpc/message.ts and conversation.clearMessages in server/routerTrpc/conversation.ts. Although these procedures require...