PT-2026-78450

Joomla Extension - cmsjunkie.com - Insecure Direct Object Reference multiple frontend/API actions in J-BusinessDirectory 6.2.3...

EUVD-2026-61098

Kurrier is a modern, self-hosted workspace for email, calendar, contacts, and storage. Prior to 1.2.4, Kurrier API endpoints for listing and retrieving webhook and identity resources did not enforce ownership checks for authenticated API requests. An attacker with a valid API key could use anothe...

CVE-2026-74009 WordPress Razorpay for WooCommerce plugin <= 4.8.7 - Insecure Direct Object References (IDOR) vulnerability

Unauthenticated Insecure Direct Object References IDOR in Razorpay for WooCommerce = 4.8.7 versions...

CVE-2026-73395 WordPress Booking calendar, Appointment Booking System plugin <= 3.2.36 - Insecure Direct Object References (IDOR) vulnerability

Unauthenticated Insecure Direct Object References IDOR in Booking calendar, Appointment Booking System = 3.2.36 versions...

CVE-2026-73395 WordPress Booking calendar, Appointment Booking System plugin <= 3.2.36 - Insecure Direct Object References (IDOR) vulnerability

Unauthenticated Insecure Direct Object References IDOR in Booking calendar, Appointment Booking System = 3.2.36 versions...

CVE-2026-73395

The WordPress plugin Booking calendar, Appointment Booking System (versions ≤ 3.2.36) has an unauthenticated IDOR flaw, discovered by Jakub Herman, allowing remote attackers to access or modify objects without authentication. CVSS 3.1 scores 6.5 (Medium) with no in-the-wild exploitation reported....

CVE-2026-73395

Unauthenticated Insecure Direct Object References IDOR in Booking calendar, Appointment Booking System = 3.2.36 versions...

CVE-2026-73189

...

EUVD-2026-60939

Subscriber Insecure Direct Object References IDOR in WP Crowdfunding 2.2.1 versions...

CVE-2026-66634 WordPress Modal Survey plugin <= 2.0.2.2.3 - Insecure Direct Object References (IDOR) vulnerability

Subscriber Insecure Direct Object References IDOR in Modal Survey = 2.0.2.2.3 versions...

EUVD-2026-60919

Subscriber Insecure Direct Object References IDOR in Modal Survey = 2.0.2.2.3 versions...

CVE-2026-66634

Subscriber Insecure Direct Object References IDOR in Modal Survey = 2.0.2.2.3 versions...

WordPress Booking calendar, Appointment Booking System plugin <= 3.2.36 - Insecure Direct Object References (IDOR) vulnerability

Insecure Direct Object References IDOR vulnerability discovered by Jakub Herman in WordPress Plugin Booking calendar, Appointment Booking System versions = 3.2.36...

WordPress Forminator Forms plugin <= 1.55.0.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'draft' Parameter vulnerability

Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'draft' Parameter vulnerability discovered by se1en in WordPress Plugin Forminator versions = 1.55.0.2...

WordPress Password Protect WordPress Lite plugin <= 1.9.20 - Insecure Direct Object Reference to Authenticated (Contributor+) Password Protected Post Password Update vulnerability

Insecure Direct Object Reference to Authenticated Contributor+ Password Protected Post Password Update vulnerability discovered by Dmitrii Ignatyev - CleanTalk Inc in WordPress Plugin PPWP versions = 1.9.20...

WordPress Online Scheduling and Appointment Booking System - Bookly plugin <= 27.7 - Authenticated (Staff+) Insecure Direct Object Reference to Sensitive Information Exposure via 'params[id]' Parameter vulnerability

WordPress Online Scheduling and Appointment Booking System - Bookly plugin = 27.7 - Authenticated Staff+ Insecure Direct Object Reference to Sensitive Information Exposure via 'paramsid' Parameter vulnerability discovered by Raihan Adi Arba in WordPress Plugin Bookly versions = 27.7...

WordPress Appointment Booking Calendar - Simply Schedule Appointments Booking Plugin plugin <= 1.6.12.10 - Authenticated (Contributor+) Insecure Direct Object Reference to Sensitive Information Exposure vulnerability

WordPress Appointment Booking Calendar - Simply Schedule Appointments Booking Plugin plugin = 1.6.12.10 - Authenticated Contributor+ Insecure Direct Object Reference to Sensitive Information Exposure vulnerability discovered by Michael Iden Mickhat - Hack The Box in WordPress Plugin Simply Schedu...

PT-2026-77082

Subscriber Insecure Direct Object References IDOR in WP Crowdfunding 2.2.1 versions...

CVE-2026-75106

OpnForm (open-source form builder) contains a critical vulnerability in its editable-submission secret derivation mechanism. Secrets are generated from sequential row identifiers using Hashids with an empty default salt , making them fully predictable. An unauthenticated attacker can compute vali...

WordPress Razorpay for WooCommerce plugin <= 4.8.7 - Insecure Direct Object References (IDOR) vulnerability

Insecure Direct Object References IDOR vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Razorpay for WooCommerce versions = 4.8.7...