CVE-2026-93399

CVE-2026-93399 — Bookly IDOR order token disclosure & booking rollback Python 3 PoC for CVE-2026-93399 in Bookly bookly-responsive-appointment-booking-tool. Description PoCbit / GitHub CVE-2026-93399 — Bookly ≤ 28.2 suffers from Insecure Direct Object Reference CWE-639 on public booking AJAX:...

EUVD-2026-91258

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 5.7.1 via the OsPaypalConnectController::createorderfortransaction action registered as a public unauthenticate...

CVE-2026-94432

The Appointment Booking Plugin – LatePoint for WordPress is vulnerable to an Insecure Direct Object Reference (IDOR) in versions up to and including 5.7.1 . The flaw exists in the OsPaypalConnectController::create_order_for_transaction() action, which is exposed as an unauthenticated route via wp...

CVE-2026-105029: Authorization Bypass Through User-Controlled Key

UVdesk support-center-bundle before 1.1.3.3 contains an insecure direct object reference vulnerability in the rateTicket action of Controller/Ticket.php that allows authenticated customers to rate other customers' tickets. Attackers can supply arbitrary ticket IDs, which are loaded without an...

PT-2026-104140

Name of the Vulnerable Software and Affected Versions LatePoint | Calendar & Scheduling for WordPress versions prior to 5.7.2 Description An Insecure Direct Object Reference exists via the OsPaypalConnectController::create order for transaction action, which is registered as a public route throug...

PT-2026-104462

UVdesk support-center-bundle before 1.1.3.3 contains an insecure direct object reference vulnerability in the rateTicket action of Controller/Ticket.php that allows authenticated customers to rate other customers' tickets. Attackers can supply arbitrary ticket IDs, which are loaded without an...

CVE-2026-93882

The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 4.4.8 via the CourseMaterialTemplate::rendermaterialitems callback exposed on the public lp-ajax-handle...

EUVD-2026-90544

The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 4.4.8 via the CourseMaterialTemplate::rendermaterialitems callback exposed on the public lp-ajax-handle...

CVE-2026-93882

The LearnPress – WordPress LMS Plugin (versions up to and including 4.4.8 ) is vulnerable to an Insecure Direct Object Reference (IDOR) in the CourseMaterialTemplate::render_material_items() callback. This function is exposed via the public lp-ajax-handle (load_content_via_ajax) endpoint, which i...

CVE-2026-91109

The Simply Schedule Appointments plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.6.12.31 via the 'completegroup' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with...

CVE-2026-91109 Simply Schedule Appointments <= 1.6.12.31 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Disclosure via 'complete_group' Parameter

The Simply Schedule Appointments plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.6.12.31 via the 'completegroup' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with...

CVE-2026-91109 Simply Schedule Appointments <= 1.6.12.31 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Disclosure via 'complete_group' Parameter

The Simply Schedule Appointments plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.6.12.31 via the 'completegroup' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with...

CVE-2026-91109

The Simply Schedule Appointments plugin for WordPress is vulnerable to an Insecure Direct Object Reference (IDOR) in versions up to and including 1.6.12.31 . The root cause is a lack of validation on a user-controlled key within the 'complete_group' parameter. Authenticated attackers with subscri...

EUVD-2025-209816

The Cost Calculator Builder plugin for WordPress is vulnerable to Unauthenticated Price Manipulation and Insecure Direct Object Reference IDOR in all versions up to, and including, 4.0.1 only when used in combination with Cost Calculator Builder PRO. This is due to the ccbwoocommercepayment AJAX...

PT-2026-103665

Name of the Vulnerable Software and Affected Versions Simply Schedule Appointments versions prior to 1.6.12.32 Description An Insecure Direct Object Reference IDOR exists due to missing validation on a user-controlled key. Authenticated attackers with subscriber-level access or higher can exploit...

PT-2026-103719

Name of the Vulnerable Software and Affected Versions LearnPress – WordPress LMS Plugin for Create and Sell Online Courses versions prior to 4.4.9 Description An Insecure Direct Object Reference exists via the CourseMaterialTemplate::render material items callback exposed on the public...

CVE-2026-93758

A flaw was found in Mongoid. An authenticated remote attacker with basic application privileges could exploit an insecure direct object reference in the nested attributes handling. This vulnerability allows the attacker to reference and manipulate record identifiers belonging to other users,...

CVE-2026-100626

capgo through 12.128.2 contains an insecure direct object reference vulnerability in the PUT /app/:appId endpoint that accepts attacker-controlled icon storage paths. Authenticated users can supply arbitrary paths in the private images bucket and obtain service-role-signed URLs valid for 7 days t...

EUVD-2026-87770

capgo through 12.128.2 contains an insecure direct object reference vulnerability in the PUT /app/:appId endpoint that accepts attacker-controlled icon storage paths. Authenticated users can supply arbitrary paths in the private images bucket and obtain service-role-signed URLs valid for 7 days t...

CVE-2026-100626

Versions of capgo through 12.128.2 are vulnerable to an Insecure Direct Object Reference (IDOR) vulnerability in the PUT /app/:appId endpoint. The root cause is that the endpoint accepts attacker-controlled icon storage paths . This allows authenticated users to provide arbitrary paths in the pri...