CVE-2023-36643

== Affected Software %hardbreaks Vendor: ITB-GmbH Affected Products: TradePro v9.5 Component: Function Customer; Action oordershow Confirmed: yes == Attack Vector %hardbreaks Type: Incorrect Access Control Access-Type: Remote Impact: Information Disclosure Incorrect Access Control in function...

EUVD-2026-102650

The Klarna for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.13.3 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to access any...

PT-2026-115435

The Klarna for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.13.3 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to access any...

WordPress Klarna for WooCommerce: Authorization issue vulnerability

WordPress Klarna for WooCommerce 4.13.3 and earlier versions have a licensing issue vulnerability. This vulnerability arises from the plugin’s failure to properly verify whether the user has the necessary permissions to perform certain operations. As a result, unauthenticated attackers can access...

WordPress RestroPress plugin <= 3.4.7 - Unauthenticated Order Enumeration and Order Note Modification vulnerability

Unauthenticated Order Enumeration and Order Note Modification vulnerability discovered by Usama Arshad in WordPress Plugin RestroPress versions = 3.4.7...

CVE-2026-85009

The RestroPress WordPress plugin through 3.4.6 does not verify ownership in its payment-recovery flow before acting on a request-supplied order identifier, allowing unauthenticated attackers to enumerate which orders are in a recoverable state and to write notes to another customer's order...

CVE-2026-85009 RestroPress <= 3.4.6 - Unauthenticated Order Enumeration and Order Note Modification via Payment Recovery

The RestroPress WordPress plugin through 3.4.6 does not verify ownership in its payment-recovery flow before acting on a request-supplied order identifier, allowing unauthenticated attackers to enumerate which orders are in a recoverable state and to write notes to another customer's order...

CVE-2026-85009

The RestroPress WordPress plugin, in versions 3.4.6 and earlier , contains an authorization bypass vulnerability in its payment-recovery flow . The software fails to verify ownership before processing a request-supplied order identifier. This allows unauthenticated attackers to enumerate orders i...

EUVD-2026-82664

The RestroPress WordPress plugin through 3.4.6 does not verify ownership in its payment-recovery flow before acting on a request-supplied order identifier, allowing unauthenticated attackers to enumerate which orders are in a recoverable state and to write notes to another customer's order...

CVE-2026-85009 RestroPress <= 3.4.6 - Unauthenticated Order Enumeration and Order Note Modification via Payment Recovery

The RestroPress WordPress plugin through 3.4.6 does not verify ownership in its payment-recovery flow before acting on a request-supplied order identifier, allowing unauthenticated attackers to enumerate which orders are in a recoverable state and to write notes to another customer's order...

CVE-2026-85009: Authorization Bypass Through User-Controlled Key

The RestroPress WordPress plugin through 3.4.6 does not verify ownership in its payment-recovery flow before acting on a request-supplied order identifier, allowing unauthenticated attackers to enumerate which orders are in a recoverable state and to write notes to another customer's order...

CVE-2026-80339 Payment Plugins for Stripe WooCommerce < 4.0.12 - Unauthenticated Customer PII Disclosure via order-pay

The Payment Plugins for Stripe WooCommerce WordPress plugin before 4.0.12 does not validate the order key before adding order data to the JavaScript configuration it outputs on the front end, allowing unauthenticated users to obtain the billing details of any order, together with the secret that...

CVE-2026-82911: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF in the OrderConfirmController at GET /order/confirm/ordernumber in Roskus Prospero Flow CRM before 5.15.11 allows an unauthenticated attacker to confirm any order on behalf of an authenticated user by directing them to a crafted page. Laravel's VerifyCsrfToken...

CVE-2026-81200

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.42 does not correctly restrict access to order information, allowing any user with the instructor role to read other users' order billing details, including name, email address, phone number and postal address, by enumerating order...

CVE-2026-81200

The MasterStudy LMS WordPress plugin (versions before 3.7.42 ) contains an IDOR (Insecure Direct Object Reference) vulnerability. Due to insufficient access control, any user assigned the instructor role can access and read other users' order billing details—including names, email addresses, phon...

CVE-2026-81200 MasterStudy LMS < 3.7.42 - Instructor+ Cross-Tenant Order Billing PII Disclosure via IDOR

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.42 does not correctly restrict access to order information, allowing any user with the instructor role to read other users' order billing details, including name, email address, phone number and postal address, by enumerating order...

EUVD-2026-57079

The WP Crowdfunding WordPress plugin before 2.2.1 does not verify order ownership before returning order details, allowing any authenticated users such as Subscribers to read the personal data of any WooCommerce order and enumerate every order in the store...

CVE-2026-9027

The CorvusPay WooCommerce Payment Gateway plugin for WordPress is vulnerable to Payment Bypass via Improper Verification of Cryptographic Signature in all versions up to, and including, 2.7.4. The corvuspaysuccesshandler function registers the REST endpoint POST /wp-json/corvuspay/success/ with...

CVE-2026-41471: Authorization Bypass Through User-Controlled Key

The Easy PayPal Events & Tickets plugin for WordPress before version 1.4 contains an information disclosure vulnerability in the QR code scanning endpoint that allows unauthenticated attackers to enumerate and retrieve all customer order records. Attackers can iterate over sequential WordPress po...

GHSA-7VVP-J573-5584 Shopware: Unauthenticated data extraction possible through store-api.order endpoint

Summary An insufficient check on the filter types for unauthenticated customers allows access to orders of other customers. This is part of the deepLinkCode support on the store-api.order endpoint. Details Data Exposure Depending on the order payload configuration, attackers may retrieve: -...