CVE-2026-47230

Admidio is an open-source user management solution. Prior to version 5.0.10, modules/documents-files.php mode filerenamesave shares the same root-cause shape as the cross-folder move bug 05-documents-cross-folder-move-idor.md: the top-level rights check at lines 79-89 validates hasUploadRight on...

CVE-2026-47231 Admidio has IDOR in `documents-files.php` `mode=move_save` that lets any folder-uploader exfiltrate files from private folders

Admidio is an open-source user management solution. Prior to version 5.0.10, modules/documents-files.php gates state-changing modes by checking that the actor has hasUploadRight on the URL parameter folderuuid. The movesave handler then operates on a separate URL parameter fileuuid and calls...

CVE-2026-47231

CVE-2026-47231 (Admidio) : The vulnerability is an IDOR in modules/documents-files.php (mode=move_save). The move operation validates rights only on the destination folder, not the source containing the file, enabling a user with a single folder upload right to move files out of private folders a...

CVE-2026-47231 Admidio has IDOR in `documents-files.php` `mode=move_save` that lets any folder-uploader exfiltrate files from private folders

Admidio is an open-source user management solution. Prior to version 5.0.10, modules/documents-files.php gates state-changing modes by checking that the actor has hasUploadRight on the URL parameter folderuuid. The movesave handler then operates on a separate URL parameter fileuuid and calls...

CVE-2026-47230 Admidio: IDOR in documents-files.php allows cross-folder file rename and description changes by unauthorized uploaders

Admidio is an open-source user management solution. Prior to version 5.0.10, modules/documents-files.php mode filerenamesave shares the same root-cause shape as the cross-folder move bug 05-documents-cross-folder-move-idor.md: the top-level rights check at lines 79-89 validates hasUploadRight on...

CVE-2026-47230 Admidio: IDOR in documents-files.php allows cross-folder file rename and description changes by unauthorized uploaders

Admidio is an open-source user management solution. Prior to version 5.0.10, modules/documents-files.php mode filerenamesave shares the same root-cause shape as the cross-folder move bug 05-documents-cross-folder-move-idor.md: the top-level rights check at lines 79-89 validates hasUploadRight on...

CVE-2026-47230

Admidio is an open-source user management solution. Prior to version 5.0.10, modules/documents-files.php mode filerenamesave shares the same root-cause shape as the cross-folder move bug 05-documents-cross-folder-move-idor.md: the top-level rights check at lines 79-89 validates hasUploadRight on...

EUVD-2026-57207

Admidio is an open-source user management solution. Prior to version 5.0.10, modules/documents-files.php mode filerenamesave shares the same root-cause shape as the cross-folder move bug 05-documents-cross-folder-move-idor.md: the top-level rights check at lines 79-89 validates hasUploadRight on...

CVE-2026-47230

Summary: CVE-2026-47230 in Admidio exposes an IDOR vulnerability in the documents-files.php rename flow. The top-level rights check validates upload rights on the folder_uuid, but the actual rename uses file_uuid via getFileForDownload with no verification of the file’s source folder. This allows...

CVE-2026-16737

The WP Travel Engine WordPress plugin before 6.8.5 does not perform authorization or ownership checks when loading a caller-supplied booking identifier in one of its unauthenticated cart actions, allowing unauthenticated attackers to disclose any customer's booking order details and their stored...

CVE-2026-14858

The WP Crowdfunding WordPress plugin before 2.2.1 does not verify order ownership before returning order details, allowing any authenticated users such as Subscribers to read the personal data of any WooCommerce order and enumerate every order in the store...

CVE-2026-14857

The WP Crowdfunding WordPress plugin before 2.2.1 does not verify ownership of a campaign before allowing its update history to be modified and a notification email sent to its backers, allowing any authenticated users such as Subscribers to alter other users' campaigns...

CVE-2026-13168

The Eventin WordPress plugin before 4.1.20 does not properly restrict access to stored customer records, allowing users with contributor-level access and above to read other customers' personal data such as names and email addresses...

EUVD-2026-57107

The Order Sync with Zendesk for WooCommerce WordPress plugin before 2.2.3 does not perform any capability check on one of its REST API endpoints, and does not verify that the requester owns the account being queried, allowing unauthenticated attackers to retrieve the order history and purchase...

EUVD-2026-57090

The WP Travel Engine WordPress plugin before 6.8.5 does not perform authorization or ownership checks when loading a caller-supplied booking identifier in one of its unauthenticated cart actions, allowing unauthenticated attackers to disclose any customer's booking order details and their stored...

CVE-2026-14858 WP Crowdfunding < 2.2.1 - Subscriber+ Order Data Disclosure via IDOR

The WP Crowdfunding WordPress plugin before 2.2.1 does not verify order ownership before returning order details, allowing any authenticated users such as Subscribers to read the personal data of any WooCommerce order and enumerate every order in the store...

CVE-2026-14858

The CVE affects the WP Crowdfunding WordPress plugin prior to version 2.2.1. It fails to verify order ownership when returning order details, enabling any authenticated user (e.g., Subscribers) to read personal data of any WooCommerce order and enumerate all orders. Root cause is an insecure acce...

CVE-2026-13177

The Eventin WordPress plugin before 4.1.20 does not properly restrict access to individual order records, allowing users with contributor-level access and above to read other customers' order data including personal information by iterating order identifiers...

CVE-2026-14857 WP Crowdfunding < 2.2.1 - Subscriber+ Campaign Update Modification via IDOR

The WP Crowdfunding WordPress plugin before 2.2.1 does not verify ownership of a campaign before allowing its update history to be modified and a notification email sent to its backers, allowing any authenticated users such as Subscribers to alter other users' campaigns...

CVE-2026-13612 KiviCare < 4.5.2 - Patient+ Cross-Patient Bill, Invoice and Appointment Disclosure via IDOR

The KiviCare WordPress plugin before 4.5.2 does not verify that the requesting user owns the records being accessed, allowing authenticated patient-level users to read other patients' bills, invoices and appointment details...