WordPress WPshop 2 plugin 2.0.0-2.6.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Key Generation

Insecure Direct Object Reference to Authenticated Subscriber+ Arbitrary User Key Generation vulnerability discovered by kr0d in WordPress Plugin WP shop versions 2.0.0-2.6.0...

WordPress User Registration plugin <= 4.2.1 - Insecure Direct Object Reference to Unauthenticated Limited User Deletion vulnerability

Insecure Direct Object Reference to Unauthenticated Limited User Deletion vulnerability discovered by wesley wcraft in WordPress Plugin User Registration versions = 4.2.1...

WordPress plugin Homey 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

WordPress WordPress Simple PayPal Shopping Cart plugin <= 5.1.3 - Insecure Direct Object Reference vulnerability

Insecure Direct Object Reference vulnerability discovered by Jack Taylor in WordPress Plugin Simple Shopping Cart versions = 5.1.3...

Sematell ReplyOne 安全漏洞

Sematell ReplyOne is an artificial intelligence-based reply management software from Sematell. A security vulnerability exists in Sematell ReplyOne version 7.4.3.0, which stems from insufficient permissions on the /rest/sessions endpoint and could lead to unsafe direct object references...

WordPress Homey Theme <= 2.4.4 is vulnerable to Insecure Direct Object References (IDOR)

Software Homey Type Theme Vulnerable versions = 2.4.4 Fixed in 2.4.5 OWASP Top 10 A7: Identification and Authentication Failures Classification Insecure Direct Object References IDOR CVE CVE-2025-1327 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID d8b4f513f58e Credits a00...

WordPress Woocommerce Automatic Order Printing plugin <= 4.1 - Insecure Direct Object Reference to Authenticated (Subscriber+) Order Information Disclosure vulnerability

Insecure Direct Object Reference to Authenticated Subscriber+ Order Information Disclosure vulnerability discovered by Lucio Sá in WordPress Plugin Woocommerce Automatic Order Printing versions = 4.1...

CVE-2025-39434 WordPress Avatar plugin <= 0.1.4 - Insecure Direct Object References (IDOR) vulnerability

Authorization Bypass Through User-Controlled Key vulnerability in Scott Taylor Avatar avatar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Avatar: from n/a through = 0.1.4...

WordPress Avatar plugin <= 0.1.4 - Insecure Direct Object References (IDOR) vulnerability

Insecure Direct Object References IDOR vulnerability discovered by Nguyen Xuan Chien Patchstack Alliance in WordPress Plugin Avatar versions = 0.1.4...

WordPress plugin User Registration & Membership 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

WordPress plugin User Registration & Membership 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

WordPress User Registration plugin <= 4.1.3 - Insecure Direct Object Reference to Unauthenticated Membership Modification vulnerability

Insecure Direct Object Reference to Unauthenticated Membership Modification vulnerability discovered by wesley wcraft in WordPress Plugin User Registration versions = 4.1.3...

WordPress User Registration plugin <= 4.1.3 - Insecure Direct Object Reference to Authenticated (Subscriber+) User Password Update vulnerability

Insecure Direct Object Reference to Authenticated Subscriber+ User Password Update vulnerability discovered by wesley wcraft in WordPress Plugin User Registration versions = 4.1.3...

CVE-2025-3014

Insecure Direct Object References IDOR in access control in Tracking 2.1.4 on NightWolf Penetration Testing allows an attacker to access via manipulating request parameters or object references...

CVE-2025-3013

Insecure Direct Object References IDOR in access control in Customer Portal before 2.1.4 on NightWolf Penetration Testing allows an attacker to access via manipulating request parameters or object references...

WordPress JS Job Manager Plugin <= 2.0.2 - Insecure Direct Object References (IDOR) vulnerability

Insecure Direct Object References IDOR vulnerability discovered by Tran Hoang Tuan Kiet in WordPress Plugin JS Job Manager versions = 2.0.2...

WordPress JobBoard Job listing plugin Plugin <= 1.2.8 - Insecure Direct Object References (IDOR) vulnerability

Insecure Direct Object References IDOR vulnerability discovered by Tran Hoang Tuan Kiet in WordPress Plugin JobBoard Job listing versions = 1.2.8...

CVE-2025-31867 WordPress JS Job Manager Plugin <= 2.0.2 - Insecure Direct Object References (IDOR) vulnerability

Authorization Bypass Through User-Controlled Key vulnerability in JoomSky JS Job Manager js-jobs allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JS Job Manager: from n/a through = 2.0.2...

CVE-2025-31867 WordPress JS Job Manager Plugin <= 2.0.2 - Insecure Direct Object References (IDOR) vulnerability

Authorization Bypass Through User-Controlled Key vulnerability in JoomSky JS Job Manager js-jobs allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JS Job Manager: from n/a through = 2.0.2...

CVE-2025-31833

CVE-2025-31833 describes an Authorization bypass via a user-controlled key in the Themeglow JobBoard Job Listing WordPress plugin, affecting the JobBoard Job listing plugin (vendor/themeglow) from n/a through 1.2.7. The accompanying metrics show CVSS 3.1 (base score 4.9, MEDIUM), with vector: AV:...