CVE-2026-100514: Authorization Bypass Through User-Controlled Key

Unauthenticated Insecure Direct Object References IDOR in REST API Log = 1.7.2 versions...

WordPress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin <= 4.4.8 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure vulnerability

Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure vulnerability discovered by Khoa Dang in WordPress Plugin LearnPress versions = 4.4.8...

CVE-2026-97259

The Pay with Vipps for WooCommerce plugin (versions up to and including 6.2.4 ) is vulnerable to an Insecure Direct Object References (IDOR) flaw. This Authorization Bypass occurs because of incorrectly configured access control security levels, allowing attackers to exploit a User-Controlled Key...

CVE-2026-97259 WordPress Pay with Vipps for WooCommerce plugin <= 6.2.4 - Insecure Direct Object References (IDOR) vulnerability

Authorization Bypass Through User-Controlled Key vulnerability in WP Hosting AS Pay with Vipps for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Pay with Vipps for WooCommerce: from n/a through 6.2.4...

CVE-2026-97282

Unauthenticated Insecure Direct Object References IDOR in Review Schema = 3.1.0 versions...

CVE-2026-97066

Unauthenticated Insecure Direct Object References IDOR in GiveWP = 4.16.9 versions...

CVE-2026-97074

Subscriber Insecure Direct Object References IDOR in Newsletters, Email Marketing, SMS and Popups by Omnisend = 1.9.0 versions...

CVE-2026-97078

Unauthenticated Insecure Direct Object References IDOR in Client Invoicing by Sprout Invoices = 20.8.17 versions...

CVE-2026-97079

Subscriber Insecure Direct Object References IDOR in Webba Booking = 6.5.0 versions...

CVE-2026-96347

Subscriber Insecure Direct Object References IDOR in Bookly = 28.2 versions...

CVE-2026-94673

Unauthenticated Insecure Direct Object References IDOR in Simply Schedule Appointments = 1.6.12.31 versions...

CVE-2026-94672

Contributor Insecure Direct Object References IDOR in Safe SVG = 2.5.0 versions...

CVE-2026-94173

Contributor Insecure Direct Object References IDOR in Business Directory = 6.4.27 versions...

CVE-2026-62081

Contributor Insecure Direct Object References IDOR in Flexible PDF Coupons = 1.14.11 versions...

CVE-2026-97282 WordPress Review Schema plugin <= 3.1.0 - Insecure Direct Object References (IDOR) vulnerability

Unauthenticated Insecure Direct Object References IDOR in Review Schema = 3.1.0 versions...

CVE-2026-97282

The Review Schema WordPress plugin versions

EUVD-2026-89925

Unauthenticated Insecure Direct Object References IDOR in Review Schema = 3.1.0 versions...

EUVD-2026-89897

Subscriber Insecure Direct Object References IDOR in Webba Booking = 6.5.0 versions...

CVE-2026-97079 WordPress Webba Booking plugin <= 6.5.0 - Insecure Direct Object References (IDOR) vulnerability

Subscriber Insecure Direct Object References IDOR in Webba Booking = 6.5.0 versions...

CVE-2026-97079 WordPress Webba Booking plugin <= 6.5.0 - Insecure Direct Object References (IDOR) vulnerability

Subscriber Insecure Direct Object References IDOR in Webba Booking = 6.5.0 versions...