CVE-2026-88844 MasterStudy LMS 3.6.2 - < 3.7.50 - Instructor+ Student PII Disclosure via IDOR

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not verify that the requesting user owns the course before returning its enrolled-student data, allowing users with the MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50's Instructor role to disclose the names...

CVE-2026-88844

The MasterStudy LMS WordPress Plugin for WordPress (versions 3.6.2 to 3.7.49 ) is vulnerable to an Insecure Direct Object Reference (IDOR) flaw. The plugin fails to verify if a requesting user owns a specific course before returning its enrolled-student data. This allows users with the Instructor...

CVE-2026-87966 Easy Appointments 4.0 - 4.0.2.1 - Unauthenticated Arbitrary Appointment Modification and Deletion via IDOR

The Easy Appointments WordPress plugin before 4.0.2.2 does not perform an ownership or authorization check on its unauthenticated appointment-reservation endpoint before updating an existing appointment identified by a request-supplied id, allowing unauthenticated attackers to overwrite, and...

CVE-2026-87966

The Easy Appointments WordPress plugin, in versions 4.0 through 4.0.2.1 , is vulnerable to an Insecure Direct Object Reference (IDOR) . The application fails to perform sufficient ownership or authorization checks on its unauthenticated appointment-reservation endpoint. This oversight allows an u...

CVE-2026-87966 Easy Appointments 4.0 - 4.0.2.1 - Unauthenticated Arbitrary Appointment Modification and Deletion via IDOR

The Easy Appointments WordPress plugin before 4.0.2.2 does not perform an ownership or authorization check on its unauthenticated appointment-reservation endpoint before updating an existing appointment identified by a request-supplied id, allowing unauthenticated attackers to overwrite, and...

CVE-2026-85009

The RestroPress WordPress plugin, in versions 3.4.6 and earlier , contains an authorization bypass vulnerability in its payment-recovery flow . The software fails to verify ownership before processing a request-supplied order identifier. This allows unauthenticated attackers to enumerate orders i...

CVE-2026-81340 MasterStudy LMS < 3.7.50 - Instructor+ Order Status Manipulation via IDOR

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not perform per-object ownership or capability checks when updating orders through its REST API, allowing users with the Instructor role to modify any order on the site, granting free course enrolment, revoking other users'...

CVE-2026-81340 MasterStudy LMS < 3.7.50 - Instructor+ Order Status Manipulation via IDOR

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not perform per-object ownership or capability checks when updating orders through its REST API, allowing users with the Instructor role to modify any order on the site, granting free course enrolment, revoking other users'...

CVE-2026-81340

The MasterStudy LMS WordPress Plugin (versions prior to 3.7.50 ) contains an authorization bypass vulnerability due to a lack of per-object ownership or capability checks when updating orders via its REST API . This allows authenticated users with the Instructor role to manipulate any order on th...

EUVD-2026-82608

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.6.9 via the setcustomerobject due to missing validation on a user controlled key. This makes it possible...

CVE-2026-18441

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.6.9 via the setcustomerobject due to missing validation on a user controlled key. This makes it possible...

PT-2026-95207

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A logged-in user can retrieve a list of memberships for a circle they do not belong to by guessing a 62^15 complex unique identifier. This is an Insecure Direct...

PT-2026-95248

Name of the Vulnerable Software and Affected Versions Easy Appointments versions 4.0 through 4.0.2.1 Description The plugin fails to perform ownership or authorization checks on the unauthenticated appointment-reservation endpoint. This allows unauthenticated attackers to overwrite or delete...

PT-2026-95251

Name of the Vulnerable Software and Affected Versions MasterStudy LMS WordPress Plugin versions prior to 3.7.50 Description An Insecure Direct Object Reference IDOR exists where the plugin fails to verify if the requesting user owns a course before returning its enrolled-student data. This allows...

PT-2026-95279

Name of the Vulnerable Software and Affected Versions Download Manager versions prior to 3.3.69 Description An Insecure Direct Object Reference IDOR exists in the duplicate function hooked on admin init. The issue occurs because the handler verifies only the generic edit posts capability and a...

PT-2026-95283

Name of the Vulnerable Software and Affected Versions LatePoint – Calendar Booking Plugin for Appointments and Events versions prior to 5.6.4 Description An Insecure Direct Object Reference IDOR exists in the LatePointAbilityDeleteBooking::execute function due to missing validation on a...

CVE-2026-18441 LatePoint - Appointment Booking & Scheduling <= 5.6.9 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Disclosure via 'customer[id]' Parameter

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.6.9 via the setcustomerobject due to missing validation on a user controlled key. This makes it possible...

CVE-2026-18441 LatePoint - Appointment Booking & Scheduling <= 5.6.9 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Disclosure via 'customer[id]' Parameter

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.6.9 via the setcustomerobject due to missing validation on a user controlled key. This makes it possible...

CVE-2026-18441

The LatePoint – Appointment Booking & Scheduling WordPress plugin (≤ 5.6.9) is vulnerable to an unauthenticated Insecure Direct Object Reference (IDOR) via the customer[id] parameter. The root cause is missing validation on a user-controlled key in the set_customer_object function, allowing attac...

CVE-2026-54671

WeGIA is a web manager for charitable institutions. Prior to 3.8.5, WeGIA maps InternoControle to an empty resource array in web/controle/control.php, and verificarPermissao in web/dao/MiddlewareDAO.php treats that empty array as unconditional access for every authenticated user. The methods in...