4 matches found
CVE-2026-127213
LearnPress Course Wishlist Add-on before 4.1.2 contains an insecure direct object reference vulnerability that allows remote attackers to manipulate any user's course wishlist by supplying an arbitrary userid parameter to the renderbutton callback instead of relying on the session identity...
CVE-2026-127213
The LearnPress Course Wishlist Add-on before version 4.1.2 is vulnerable to an Insecure Direct Object Reference (IDOR) . The flaw exists because the render_button callback uses a user-supplied user_id parameter instead of verifying the session identity. Attackers can exploit the publicly accessib...
CVE-2026-127213 LearnPress Course Wishlist < 4.1.2 IDOR via render_button
LearnPress Course Wishlist Add-on before 4.1.2 contains an insecure direct object reference vulnerability that allows remote attackers to manipulate any user's course wishlist by supplying an arbitrary userid parameter to the renderbutton callback instead of relying on the session identity...
EUVD-2026-125724
LearnPress Course Wishlist Add-on before 4.1.2 contains an insecure direct object reference vulnerability that allows remote attackers to manipulate any user's course wishlist by supplying an arbitrary userid parameter to the renderbutton callback instead of relying on the session identity...