CVE-2026-86111 BookWyrm through 0.9.1 Insecure Direct Object Reference in EditStatus Exposes Followers-Only and Direct Statuses

BookWyrm through 0.9.1 fails to validate user visibility permissions in the status edit endpoint, allowing authenticated attackers to read followers-only and direct-message reviews by enumerating sequential status IDs. Attackers can access the raw content of restricted statuses through the edit...

CVE-2026-81424 Accept Stripe Payments < 2.1.4 - Unauthenticated Product Substitution via IDOR

The Accept Stripe Payments WordPress plugin before 2.1.4 does not verify that the product fulfilled when a checkout is completed matches the product the authoritative payment was actually made for, checking only that the amount paid is at least the referenced product's price, allowing...

CVE-2026-85615

Openpanel before 2.3.0 contains an insecure direct object reference vulnerability in the report.getLayouts and report.resetLayout tRPC procedures that fail to bind dashboardId to the authorized projectId. Authenticated attackers can supply an arbitrary victim dashboardId with their own projectId ...

CVE-2026-85615

Openpanel before 2.3.0 is affected by an insecure direct object reference (IDOR) vulnerability in the report.getLayouts and report.resetLayout tRPC procedures. The root cause is a failure to bind dashboardId to the authorized projectId , allowing an authenticated attacker to supply an arbitrary v...

CVE-2026-85615 Openpanel before 2.3.0 Cross-Tenant IDOR via report.getLayouts

Openpanel before 2.3.0 contains an insecure direct object reference vulnerability in the report.getLayouts and report.resetLayout tRPC procedures that fail to bind dashboardId to the authorized projectId. Authenticated attackers can supply an arbitrary victim dashboardId with their own projectId ...

CVE-2026-27432 WordPress WP Rentals theme < 3.16.0 - Insecure Direct Object References (IDOR) vulnerability

Authorization Bypass Through User-Controlled Key vulnerability in sc Internet Vivoo WP Rentals allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WP Rentals: from n/a before 3.16.0...

WordPress WP Rentals theme < 3.16.0 - Insecure Direct Object References (IDOR) vulnerability

Insecure Direct Object References IDOR vulnerability discovered by Rafie Muhammad in WordPress Theme WP Rentals versions 3.16.0...

CVE-2026-85615: Authorization Bypass Through User-Controlled Key

Openpanel before 2.3.0 contains an insecure direct object reference vulnerability in the report.getLayouts and report.resetLayout tRPC procedures that fail to bind dashboardId to the authorized projectId. Authenticated attackers can supply an arbitrary victim dashboardId with their own projectId ...

CVE-2026-85389 Worklenz before 3.0.0 Authorization Bypass on Task-Scoped Endpoints

Worklenz before 3.0.0 fails to verify task ownership by organization when resolving task-scoped API endpoints, allowing authenticated users to access another tenant's task data. Attackers can query task endpoints with arbitrary task UUIDs to retrieve work logs, comments, attachments, and project...

CVE-2026-84769

Unauthenticated Insecure Direct Object References IDOR in Business Directory = 6.4.26 versions...

CVE-2026-84836

WC Ukraine Shipping is a WordPress plugin affected by an Insecure Direct Object References (IDOR) vulnerability in versions 1.22.3 and earlier . The flaw allows a low-privilege user (Subscriber level) to access restricted objects, resulting in high confidentiality impact and low integrity impact,...

CVE-2026-84836 WordPress WC Ukraine Shipping plugin <= 1.22.3 - Insecure Direct Object References (IDOR) vulnerability

Subscriber Insecure Direct Object References IDOR in WC Ukraine Shipping = 1.22.3 versions...

EUVD-2026-70568

Subscriber Insecure Direct Object References IDOR in WC Ukraine Shipping = 1.22.3 versions...

CVE-2026-84769 WordPress Business Directory plugin <= 6.4.26 - Insecure Direct Object References (IDOR) vulnerability

Unauthenticated Insecure Direct Object References IDOR in Business Directory = 6.4.26 versions...

EUVD-2026-70577

Unauthenticated Insecure Direct Object References IDOR in Business Directory = 6.4.26 versions...

CVE-2026-84769

CVE-2026-84769 affects the WordPress Business Directory plugin in versions

CVE-2026-84769 WordPress Business Directory plugin <= 6.4.26 - Insecure Direct Object References (IDOR) vulnerability

Unauthenticated Insecure Direct Object References IDOR in Business Directory = 6.4.26 versions...

PT-2026-85120

Subscriber Insecure Direct Object References IDOR in WC Ukraine Shipping = 1.22.3 versions...

CVE-2026-84771

Unauthenticated Insecure Direct Object References IDOR in PublishPress Permissions = 4.8.3 versions...

CVE-2026-84771

This unauthenticated IDOR vulnerability affects the WordPress PublishPress Permissions plugin in versions 4.8.3 and earlier . Discovered by Brobicho and assigned by Patchstack , it allows a remote attacker with no privileges to access resources they should not, resulting in a low confidentiality ...