CVE-2026-94246

The Wallet System for WooCommerce WordPress plugin, versions before 2.8.0 , is vulnerable to an Insecure Direct Object Reference (IDOR) flaw. The application fails to verify that the wallet account specified in a withdrawal submission belongs to the authenticated user. This allows any authenticat...

CVE-2026-94245 Wallet System for WooCommerce 2.0.0 - 2.7.10 - Subscriber+ Arbitrary Wallet Balance Theft via IDOR

The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not verify that the user submitting a wallet transfer owns the wallet being debited, allowing any authenticated user, including one with only the Subscriber role, to move an arbitrary user's wallet balance, including an...

CVE-2026-94245

The Wallet System for WooCommerce WordPress plugin (versions before 2.8.0 ) contains an authorization bypass vulnerability. The plugin fails to verify if the user submitting a wallet transfer actually owns the wallet being debited. This allows any authenticated user, including those with only the...

CVE-2026-105197

The LatePoint (Appointment Booking Plugin) for WordPress is vulnerable in versions before 5.6.5 . The software fails to verify if a backend staff user is authorized to act on a specific record during a deletion request. This Insecure Direct Object Reference (IDOR) flaw allows an authenticated use...

CVE-2026-105197 LatePoint < 5.6.5 - Agent+ Arbitrary Order, Customer and Transaction Deletion via IDOR

The Appointment Booking Plugin WordPress plugin before 5.6.5 does not verify that a backend staff user is authorized to act on the specific record targeted for deletion, allowing an authenticated user with a record-scoped staff role to irreversibly delete any order, customer, or transaction on th...

CVE-2026-105198

The LatePoint (Appointment Booking Plugin) for WordPress is vulnerable to an Insecure Direct Object Reference (IDOR) flaw in versions before 5.7.3 . The root cause is a failure to verify that a caller owns the order referenced by an order-item identifier before rendering the confirmation summary....

CVE-2026-105198 LatePoint < 5.7.3 - Unauthenticated Customer PII Disclosure via IDOR

The Appointment Booking Plugin WordPress plugin before 5.7.3 does not verify that the caller owns the order referenced by an order-item identifier before rendering that order's confirmation summary, letting an unauthenticated visitor retrieve any customer's name, contact details and order...

CVE-2026-104645 Image Photo Gallery Final Tiles Grid < 3.6.14 - Contributor+ Arbitrary Gallery Cloning, Image Modification and Post Meta Update via IDOR

The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.14 does not properly verify authorization on several of its gallery and image management actions, checking ownership against a different object than the one being acted on, or omitting the check entirely, allowing any...

CVE-2026-104645

The Image Photo Gallery Final Tiles Grid WordPress plugin, in versions prior to 3.6.14 , contains an authorization bypass vulnerability. The root cause is the failure to properly verify ownership on several gallery and image management actions, either by checking ownership against the wrong objec...

PT-2026-107992

EspoCRM before 10.0.5 contains an insecure direct object reference vulnerability in PersonalAccountService that allows users with Email Account scope access to retrieve other users' IMAP passwords. Attackers who know a victim's Email Account record ID can request that record to steal stored IMAP...

CVE-2026-17538

The LatePoint - Appointment Booking & Reservation plugin for WordPress (versions

CVE-2026-107270

Gophish through 0.12.1 contains an insecure direct object reference vulnerability that allows authenticated users to take over other users' groups, templates, landing pages and sending profiles. Attackers can supply another user's sequential id in POST requests to /api/groups/, /api/templates/,...

CVE-2026-107270 Gophish through 0.12.1 Object Takeover via Client-Supplied ID on API Create Endpoints

Gophish through 0.12.1 contains an insecure direct object reference vulnerability that allows authenticated users to take over other users' groups, templates, landing pages and sending profiles. Attackers can supply another user's sequential id in POST requests to /api/groups/, /api/templates/,...

CVE-2026-107270 Gophish through 0.12.1 Object Takeover via Client-Supplied ID on API Create Endpoints

Gophish through 0.12.1 contains an insecure direct object reference vulnerability that allows authenticated users to take over other users' groups, templates, landing pages and sending profiles. Attackers can supply another user's sequential id in POST requests to /api/groups/, /api/templates/,...

CVE-2026-107270 Gophish through 0.12.1 Object Takeover via Client-Supplied ID on API Create Endpoints

Gophish through 0.12.1 contains an insecure direct object reference vulnerability that allows authenticated users to take over other users' groups, templates, landing pages and sending profiles. Attackers can supply another user's sequential id in POST requests to /api/groups/, /api/templates/,...

EUVD-2026-94401

Gophish through 0.12.1 contains an insecure direct object reference vulnerability that allows authenticated users to take over other users' groups, templates, landing pages and sending profiles. Attackers can supply another user's sequential id in POST requests to /api/groups/, /api/templates/,...

WordPress Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin <= 5.6.9 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Customer PII Modification vulnerability

Authenticated Subscriber+ Insecure Direct Object Reference to Arbitrary Customer PII Modification vulnerability discovered by owlmind in WordPress Plugin LatePoint versions = 5.6.9...

CVE-2026-104651 Yaad Sarig Payment Gateway For WC < 2.2.13 - Subscriber+ Arbitrary Order Payment Manipulation via IDOR

The Yaad Sarig Payment Gateway For WC WordPress plugin before 2.2.13 does not verify authorization or that the requesting user owns the target order in several of its order payment-processing actions, allowing any authenticated user, including subscribers, to act on and alter orders belonging to...

CVE-2026-104651

The Yaad Sarig Payment Gateway For WC WordPress plugin, in versions before 2.2.13 , is vulnerable to an Insecure Direct Object Reference (IDOR) flaw. The plugin fails to verify authorization or ownership of the target order during several order payment-processing actions . This allows any authent...

CVE-2026-104651 Yaad Sarig Payment Gateway For WC < 2.2.13 - Subscriber+ Arbitrary Order Payment Manipulation via IDOR

The Yaad Sarig Payment Gateway For WC WordPress plugin before 2.2.13 does not verify authorization or that the requesting user owns the target order in several of its order payment-processing actions, allowing any authenticated user, including subscribers, to act on and alter orders belonging to...