WordPress PeproDev WooCommerce Receipt Uploader plugin <= 2.8.0 - Unauthenticated Order Receipt Tampering via IDOR vulnerability

Unauthenticated Order Receipt Tampering via IDOR vulnerability discovered by Lyris Vale in WordPress Plugin PeproDev WooCommerce Receipt Uploader versions = 2.8.0...

PT-2026-68392

Name of the Vulnerable Software and Affected Versions PeproDev WooCommerce Receipt Uploader versions prior to 2.8.1 Description The plugin is vulnerable to an unauthenticated Insecure Direct Object Reference IDOR write, which occurs when an application provides direct access to objects based on...