Common Weakness Enumeration

CWE-639

Allowed

Authorization Bypass Through User-Controlled Key

Abstraction: Base · Status: Incomplete

API response cwe.mitre.org

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

3307 vulnerabilities reference this CWE, most recent first.

GHSA-G352-7RFF-PGCM

Vulnerability from github – Published: 2023-11-28 06:30 – Updated: 2026-04-08 18:32
VLAI
Details

The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.13.3 via the su_meta shortcode due to missing validation on the user controlled keys 'key' and 'post_id'. This makes it possible for authenticated attackers, with contributor-level access and above, to retrieve arbitrary post meta values which may contain sensitive information when combined with another plugin.

Severity
4.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2023-6226"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-11-28T05:15:08Z",
    "severity": "MODERATE"
  },
  "details": "The WP Shortcodes Plugin \u2014 Shortcodes Ultimate plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.13.3 via the su_meta shortcode due to missing validation on the user controlled keys \u0027key\u0027 and \u0027post_id\u0027. This makes it possible for authenticated attackers, with contributor-level access and above, to retrieve arbitrary post meta values which may contain sensitive information when combined with another plugin.",
  "id": "GHSA-g352-7rff-pgcm",
  "modified": "2026-04-08T18:32:27Z",
  "published": "2023-11-28T06:30:23Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-6226"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/shortcodes-ultimate/trunk/includes/shortcodes/meta.php"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026old=3000576%40shortcodes-ultimate\u0026new=3000576%40shortcodes-ultimate\u0026sfp_email=\u0026sfph_mail="
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4d936a48-b300-4a41-8d28-ba34cb3c5cb7?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-G39V-QRJ6-JXRH

Vulnerability from github – Published: 2026-03-26 18:08 – Updated: 2026-03-27 21:38
VLAI
Summary
AVideo: IDOR in AI Plugin Allows Stealing Other Users' AI-Generated Metadata and Transcriptions
Details

Summary

The AI plugin's save.json.php endpoint loads AI response objects using an attacker-controlled $_REQUEST['id'] parameter without validating that the AI response belongs to the specified video. An authenticated user with AI permissions can reference any AI response ID — including those generated for other users' private videos — and apply the stolen AI-generated content (titles, descriptions, keywords, summaries, or full transcriptions) to their own video, effectively exfiltrating the information.

Details

In plugin/AI/save.json.php, the authorization flow checks that the user can edit the target video (Video::canEdit($videos_id) at line 23), but loads the AI response object from a completely separate, user-controlled parameter:

Line 29 — metatags path (no ownership check):

if(!empty($_REQUEST['ai_metatags_responses_id'])){
    $ai = new Ai_metatags_responses($_REQUEST['id']);  // Loads ANY response by ID

    if (empty($ai->getcompletion_tokens())) {
        forbiddenPage('AI Response not found');
    }
}

Line 146 — transcription path (no ownership check):

case 'text':
    if(!empty($_REQUEST['ai_transcribe_responses_id'])){
        $ait = new Ai_transcribe_responses($_REQUEST['id']);  // Loads ANY response by ID
        $value = $ait->getVtt();

The ObjectYPT base class constructor performs a simple database lookup with no authorization:

public function __construct($id = "", $refreshCache = false) {
    if (!empty($id)) {
        $this->load($id, $refreshCache);  // SELECT * WHERE id = ? — no permission check
    }
}

The loaded data is then applied to the attacker's video — titles via $video->setTitle() (line 49-51), descriptions via $video->setDescription() (lines 91-92, 100-101), and transcriptions via file_put_contents() (line 156).

In contrast, plugin/AI/delete.json.php correctly validates ownership by traversing to the parent Ai_responses record:

// delete.json.php lines 42-44 — CORRECT ownership check
$ai = new Ai_responses($aitr->getAi_responses_id());
if ($ai->getVideos_id() == $videos_id) {
    $obj->ai_transcribe_responses_id = $aitr->delete();

This proves the developers intended ownership validation but omitted it in the save endpoint.

PoC

Prerequisites: Two user accounts (attacker and victim), both with canUseAI permission. The victim has generated AI metadata or transcription for a private video.

Step 1: Attacker enumerates AI response IDs to steal metadata

AI response IDs are sequential integers. The attacker supplies their own videos_id (which they can edit) but references a victim's AI response id:

# Attacker owns video ID 5, victim's AI metatags response is ID 42
curl -b "attacker_cookies" \
  "https://target.example/plugin/AI/save.json.php" \
  -d "videos_id=5&ai_metatags_responses_id=1&id=42&label=videoTitles&index=0"

Expected result: The victim's AI-generated title (from their private video) is applied to the attacker's video (ID 5). The attacker reads back their video to see the stolen title.

Step 2: Attacker steals full transcription (higher impact)

# Victim's AI transcription response is ID 17
curl -b "attacker_cookies" \
  "https://target.example/plugin/AI/save.json.php" \
  -d "videos_id=5&ai_transcribe_responses_id=1&id=17&label=text"

Expected result: The victim's VTT transcription file is written to the attacker's video directory. The attacker can now access the full spoken content of the victim's private video by requesting the VTT subtitle file for their own video.

Step 3: Enumerate all responses

# Iterate through sequential IDs to harvest all AI responses
for id in $(seq 1 100); do
  curl -s -b "attacker_cookies" \
    "https://target.example/plugin/AI/save.json.php" \
    -d "videos_id=5&ai_metatags_responses_id=1&id=${id}&label=videoTitles&index=0"
done

Impact

  • Confidentiality breach of private video content: An attacker can steal full transcriptions (VTT subtitles) generated by AI for other users' private videos, revealing the complete spoken content without ever accessing the video file itself.
  • Metadata exfiltration: AI-generated titles, descriptions, keywords, summaries, and content ratings from other users' private videos can be read by applying them to the attacker's own video.
  • Trivial enumeration: AI response IDs are sequential integers, allowing an attacker to systematically harvest all AI-generated content across the platform.
  • Low barrier: Any user with canUseAI permission who owns at least one video can exploit this. No admin access required.

Recommended Fix

Add ownership validation in save.json.php matching what delete.json.php already does. Load the parent Ai_responses record and verify getVideos_id() matches the provided $videos_id:

// For metatags (after line 29):
if(!empty($_REQUEST['ai_metatags_responses_id'])){
    $ai = new Ai_metatags_responses($_REQUEST['id']);

    if (empty($ai->getcompletion_tokens())) {
        forbiddenPage('AI Response not found');
    }

    // ADD: Ownership validation
    $aiParent = new Ai_responses($ai->getAi_responses_id());
    if ($aiParent->getVideos_id() != $videos_id) {
        forbiddenPage('AI Response does not belong to this video');
    }
}

// For transcriptions (at line 146, inside case 'text'):
$ait = new Ai_transcribe_responses($_REQUEST['id']);

// ADD: Ownership validation
$aitParent = new Ai_responses($ait->getAi_responses_id());
if ($aitParent->getVideos_id() != $videos_id) {
    forbiddenPage('AI Response does not belong to this video');
}

$value = $ait->getVtt();
Severity
4.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "wwbn/avideo"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "26.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-33764"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-26T18:08:12Z",
    "nvd_published_at": "2026-03-27T15:16:58Z",
    "severity": "MODERATE"
  },
  "details": "## Summary\n\nThe AI plugin\u0027s `save.json.php` endpoint loads AI response objects using an attacker-controlled `$_REQUEST[\u0027id\u0027]` parameter without validating that the AI response belongs to the specified video. An authenticated user with AI permissions can reference any AI response ID \u2014 including those generated for other users\u0027 private videos \u2014 and apply the stolen AI-generated content (titles, descriptions, keywords, summaries, or full transcriptions) to their own video, effectively exfiltrating the information.\n\n## Details\n\nIn `plugin/AI/save.json.php`, the authorization flow checks that the user can edit the *target video* (`Video::canEdit($videos_id)` at line 23), but loads the AI response object from a completely separate, user-controlled parameter:\n\n**Line 29 \u2014 metatags path (no ownership check):**\n```php\nif(!empty($_REQUEST[\u0027ai_metatags_responses_id\u0027])){\n    $ai = new Ai_metatags_responses($_REQUEST[\u0027id\u0027]);  // Loads ANY response by ID\n    \n    if (empty($ai-\u003egetcompletion_tokens())) {\n        forbiddenPage(\u0027AI Response not found\u0027);\n    }\n}\n```\n\n**Line 146 \u2014 transcription path (no ownership check):**\n```php\ncase \u0027text\u0027:\n    if(!empty($_REQUEST[\u0027ai_transcribe_responses_id\u0027])){\n        $ait = new Ai_transcribe_responses($_REQUEST[\u0027id\u0027]);  // Loads ANY response by ID\n        $value = $ait-\u003egetVtt();\n```\n\nThe `ObjectYPT` base class constructor performs a simple database lookup with no authorization:\n```php\npublic function __construct($id = \"\", $refreshCache = false) {\n    if (!empty($id)) {\n        $this-\u003eload($id, $refreshCache);  // SELECT * WHERE id = ? \u2014 no permission check\n    }\n}\n```\n\nThe loaded data is then applied to the attacker\u0027s video \u2014 titles via `$video-\u003esetTitle()` (line 49-51), descriptions via `$video-\u003esetDescription()` (lines 91-92, 100-101), and transcriptions via `file_put_contents()` (line 156).\n\nIn contrast, `plugin/AI/delete.json.php` correctly validates ownership by traversing to the parent `Ai_responses` record:\n\n```php\n// delete.json.php lines 42-44 \u2014 CORRECT ownership check\n$ai = new Ai_responses($aitr-\u003egetAi_responses_id());\nif ($ai-\u003egetVideos_id() == $videos_id) {\n    $obj-\u003eai_transcribe_responses_id = $aitr-\u003edelete();\n```\n\nThis proves the developers intended ownership validation but omitted it in the save endpoint.\n\n## PoC\n\n**Prerequisites:** Two user accounts (attacker and victim), both with `canUseAI` permission. The victim has generated AI metadata or transcription for a private video.\n\n**Step 1: Attacker enumerates AI response IDs to steal metadata**\n\nAI response IDs are sequential integers. The attacker supplies their own `videos_id` (which they can edit) but references a victim\u0027s AI response `id`:\n\n```bash\n# Attacker owns video ID 5, victim\u0027s AI metatags response is ID 42\ncurl -b \"attacker_cookies\" \\\n  \"https://target.example/plugin/AI/save.json.php\" \\\n  -d \"videos_id=5\u0026ai_metatags_responses_id=1\u0026id=42\u0026label=videoTitles\u0026index=0\"\n```\n\n**Expected result:** The victim\u0027s AI-generated title (from their private video) is applied to the attacker\u0027s video (ID 5). The attacker reads back their video to see the stolen title.\n\n**Step 2: Attacker steals full transcription (higher impact)**\n\n```bash\n# Victim\u0027s AI transcription response is ID 17\ncurl -b \"attacker_cookies\" \\\n  \"https://target.example/plugin/AI/save.json.php\" \\\n  -d \"videos_id=5\u0026ai_transcribe_responses_id=1\u0026id=17\u0026label=text\"\n```\n\n**Expected result:** The victim\u0027s VTT transcription file is written to the attacker\u0027s video directory. The attacker can now access the full spoken content of the victim\u0027s private video by requesting the VTT subtitle file for their own video.\n\n**Step 3: Enumerate all responses**\n\n```bash\n# Iterate through sequential IDs to harvest all AI responses\nfor id in $(seq 1 100); do\n  curl -s -b \"attacker_cookies\" \\\n    \"https://target.example/plugin/AI/save.json.php\" \\\n    -d \"videos_id=5\u0026ai_metatags_responses_id=1\u0026id=${id}\u0026label=videoTitles\u0026index=0\"\ndone\n```\n\n## Impact\n\n- **Confidentiality breach of private video content:** An attacker can steal full transcriptions (VTT subtitles) generated by AI for other users\u0027 private videos, revealing the complete spoken content without ever accessing the video file itself.\n- **Metadata exfiltration:** AI-generated titles, descriptions, keywords, summaries, and content ratings from other users\u0027 private videos can be read by applying them to the attacker\u0027s own video.\n- **Trivial enumeration:** AI response IDs are sequential integers, allowing an attacker to systematically harvest all AI-generated content across the platform.\n- **Low barrier:** Any user with `canUseAI` permission who owns at least one video can exploit this. No admin access required.\n\n## Recommended Fix\n\nAdd ownership validation in `save.json.php` matching what `delete.json.php` already does. Load the parent `Ai_responses` record and verify `getVideos_id()` matches the provided `$videos_id`:\n\n```php\n// For metatags (after line 29):\nif(!empty($_REQUEST[\u0027ai_metatags_responses_id\u0027])){\n    $ai = new Ai_metatags_responses($_REQUEST[\u0027id\u0027]);\n    \n    if (empty($ai-\u003egetcompletion_tokens())) {\n        forbiddenPage(\u0027AI Response not found\u0027);\n    }\n    \n    // ADD: Ownership validation\n    $aiParent = new Ai_responses($ai-\u003egetAi_responses_id());\n    if ($aiParent-\u003egetVideos_id() != $videos_id) {\n        forbiddenPage(\u0027AI Response does not belong to this video\u0027);\n    }\n}\n\n// For transcriptions (at line 146, inside case \u0027text\u0027):\n$ait = new Ai_transcribe_responses($_REQUEST[\u0027id\u0027]);\n\n// ADD: Ownership validation\n$aitParent = new Ai_responses($ait-\u003egetAi_responses_id());\nif ($aitParent-\u003egetVideos_id() != $videos_id) {\n    forbiddenPage(\u0027AI Response does not belong to this video\u0027);\n}\n\n$value = $ait-\u003egetVtt();\n```",
  "id": "GHSA-g39v-qrj6-jxrh",
  "modified": "2026-03-27T21:38:32Z",
  "published": "2026-03-26T18:08:12Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-g39v-qrj6-jxrh"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33764"
    },
    {
      "type": "WEB",
      "url": "https://github.com/WWBN/AVideo/commit/aa2c46a806960a0006105df47765913394eec142"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/WWBN/AVideo"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "AVideo: IDOR in AI Plugin Allows Stealing Other Users\u0027 AI-Generated Metadata and Transcriptions"
}

GHSA-G3JM-H647-X2WG

Vulnerability from github – Published: 2026-06-05 00:31 – Updated: 2026-06-06 06:30
VLAI
Details

Insufficient policy enforcement in Paint in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: Medium)

Severity
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-11142"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-06-04T23:17:20Z",
    "severity": "MODERATE"
  },
  "details": "Insufficient policy enforcement in Paint in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: Medium)",
  "id": "GHSA-g3jm-h647-x2wg",
  "modified": "2026-06-06T06:30:28Z",
  "published": "2026-06-05T00:31:49Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-11142"
    },
    {
      "type": "WEB",
      "url": "https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html"
    },
    {
      "type": "WEB",
      "url": "https://issues.chromium.org/issues/501668745"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-G3Q3-27W2-FGMP

Vulnerability from github – Published: 2024-09-24 03:30 – Updated: 2024-09-24 03:30
VLAI
Details

The Donation Forms by Charitable – Donations Plugin & Fundraising Platform for WordPress plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.8.1.14. This is due to the plugin not properly verifying a user's identity when the ID parameter is supplied through the update_core_user() function. This makes it possible for unauthenticated attackers to update the email address and password of arbitrary user accounts, including administrators, which can then be used to log in to those user accounts.

Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2024-8791"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-09-24T03:15:03Z",
    "severity": "CRITICAL"
  },
  "details": "The Donation Forms by Charitable \u2013 Donations Plugin \u0026 Fundraising Platform for WordPress plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.8.1.14. This is due to the plugin not properly verifying a user\u0027s identity when the ID parameter is supplied through the update_core_user() function. This makes it possible for unauthenticated attackers to update the email address and password of arbitrary user accounts, including administrators, which can then be used to log in to those user accounts.",
  "id": "GHSA-g3q3-27w2-fgmp",
  "modified": "2024-09-24T03:30:44Z",
  "published": "2024-09-24T03:30:44Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-8791"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/charitable/tags/1.8.1.14/includes/users/class-charitable-user.php#L872"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/changeset/3154009/charitable/trunk/includes/users/class-charitable-user.php"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0ee60943-b583-4a99-8e62-846b380c98aa?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-G3Q3-2MXH-PWCG

Vulnerability from github – Published: 2025-09-23 12:31 – Updated: 2026-06-05 12:31
VLAI
Details

Authorization Bypass Through User-Controlled Key vulnerability in Anadolu Hayat Emeklilik Inc. AHE Mobile allows Privilege Abuse.This issue affects AHE Mobile: from 1.9.7 before 1.9.9.

Severity
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2025-9342"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-09-23T10:15:35Z",
    "severity": "MODERATE"
  },
  "details": "Authorization Bypass Through User-Controlled Key vulnerability in Anadolu Hayat Emeklilik Inc. AHE Mobile allows Privilege Abuse.This issue affects AHE Mobile: from 1.9.7 before 1.9.9.",
  "id": "GHSA-g3q3-2mxh-pwcg",
  "modified": "2026-06-05T12:31:42Z",
  "published": "2025-09-23T12:31:11Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-9342"
    },
    {
      "type": "WEB",
      "url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-25-0287"
    },
    {
      "type": "WEB",
      "url": "https://www.usom.gov.tr/bildirim/tr-25-0287"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-G3R5-HP64-FQ8F

Vulnerability from github – Published: 2022-08-23 00:00 – Updated: 2022-08-26 00:03
VLAI
Details

The WPQA Builder WordPress plugin before 5.7 which is a companion plugin to the Hilmer and Discy , does not check authorization before displaying private messages, allowing any logged in user to read other users private message using the message id, which can easily be brute forced.

Severity
4.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2022-2198"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-08-22T15:15:00Z",
    "severity": "MODERATE"
  },
  "details": "The WPQA Builder WordPress plugin before 5.7 which is a companion plugin to the Hilmer and Discy , does not check authorization before displaying private messages, allowing any logged in user to read other users private message using the message id, which can easily be brute forced.",
  "id": "GHSA-g3r5-hp64-fq8f",
  "modified": "2022-08-26T00:03:37Z",
  "published": "2022-08-23T00:00:17Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-2198"
    },
    {
      "type": "WEB",
      "url": "https://wpscan.com/vulnerability/867248f2-d497-4ea8-b3f8-0f2e8aaaa2bd"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-G495-HM74-5J37

Vulnerability from github – Published: 2026-04-11 03:30 – Updated: 2026-04-11 03:30
VLAI
Details

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.9.7. This is due to missing authorization checks in the save_course_content_order() private method, which is called unconditionally by the tutor_update_course_content_order AJAX handler. While the handler's content_parent branch includes a can_user_manage() check, the save_course_content_order() call processes attacker-supplied tutor_topics_lessons_sorting JSON without any ownership or capability verification. This makes it possible for authenticated attackers with Subscriber-level access or above to detach lessons from topics, reorder course content, and reassign lessons between topics in any course, including admin-owned courses, by sending a crafted AJAX request with manipulated topic and lesson IDs.

Severity
4.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-3371"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-04-11T02:16:01Z",
    "severity": "MODERATE"
  },
  "details": "The Tutor LMS \u2013 eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.9.7. This is due to missing authorization checks in the `save_course_content_order()` private method, which is called unconditionally by the `tutor_update_course_content_order` AJAX handler. While the handler\u0027s `content_parent` branch includes a `can_user_manage()` check, the `save_course_content_order()` call processes attacker-supplied `tutor_topics_lessons_sorting` JSON without any ownership or capability verification. This makes it possible for authenticated attackers with Subscriber-level access or above to detach lessons from topics, reorder course content, and reassign lessons between topics in any course, including admin-owned courses, by sending a crafted AJAX request with manipulated topic and lesson IDs.",
  "id": "GHSA-g495-hm74-5j37",
  "modified": "2026-04-11T03:30:30Z",
  "published": "2026-04-11T03:30:30Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3371"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/tutor/trunk/classes/Course.php#L1687"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/tutor/trunk/classes/Course.php#L1755"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/tutor/trunk/classes/Course.php#L252"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/changeset?old_path=%2Ftutor/tags/3.9.7\u0026new_path=%2Ftutor/tags/3.9.8"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f9cf0430-8577-449a-aefe-d7bf606fe2de?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-G4GQ-2RW6-X352

Vulnerability from github – Published: 2025-11-27 09:30 – Updated: 2025-11-27 09:30
VLAI
Details

The QODE Wishlist for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.2.7 via the 'qode_wishlist_for_woocommerce_wishlist_table_item_callback' function due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to update the public view of arbitrary wishlists.

Severity
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2025-13157"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-11-27T07:15:54Z",
    "severity": "MODERATE"
  },
  "details": "The QODE Wishlist for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.2.7 via the \u0027qode_wishlist_for_woocommerce_wishlist_table_item_callback\u0027 function due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to update the public view of arbitrary wishlists.",
  "id": "GHSA-g4gq-2rw6-x352",
  "modified": "2025-11-27T09:30:18Z",
  "published": "2025-11-27T09:30:18Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13157"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/qode-wishlist-for-woocommerce/trunk/inc/wishlist/shortcodes/wishlist-table/helper-ajax.php#L95"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/changeset/3402469"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b15d1992-ecf9-4253-b832-056b34f42b48?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-G4HP-PFVF-VM5W

Vulnerability from github – Published: 2024-05-23 17:23 – Updated: 2024-05-23 17:23
VLAI
Summary
SilverStripe Vulnerability on 'isDev', 'isTest' and 'flush' $_GET validation
Details

When a secure token parameter is provided to a SilverStripe site (such as isDev or flush) an empty token parameter can be provided in order to bypass normal authentication parameters.

For instance, http://www.mysite.com/?isDev=1&isDevtoken will force a site to dev mode. Alternatively, "flush" could also be used in succession to cause excessive load on a victim site and risk denial of service.

The fix in this case is to ensure that empty tokens fail the validation check.

Severity
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 3.0.13"
      },
      "package": {
        "ecosystem": "Packagist",
        "name": "silverstripe/framework"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.0.0"
            },
            {
              "fixed": "3.0.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "silverstripe/framework"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.1.0"
            },
            {
              "fixed": "3.1.13"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-05-23T17:23:55Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "When a secure token parameter is provided to a SilverStripe site (such as isDev or flush) an empty token parameter can be provided in order to bypass normal authentication parameters.\n\nFor instance, http://www.mysite.com/?isDev=1\u0026isDevtoken will force a site to dev mode. Alternatively, \"flush\" could also be used in succession to cause excessive load on a victim site and risk denial of service.\n\nThe fix in this case is to ensure that empty tokens fail the validation check.",
  "id": "GHSA-g4hp-pfvf-vm5w",
  "modified": "2024-05-23T17:23:55Z",
  "published": "2024-05-23T17:23:55Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/silverstripe/silverstripe-framework/commit/a978b891e13d22dddee7e0735a7032f13964447d"
    },
    {
      "type": "WEB",
      "url": "https://github.com/silverstripe/silverstripe-framework/commit/cb6717c3f85753bdc30087f280720c6d3f639ff3"
    },
    {
      "type": "WEB",
      "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/SS-2015-014-1.yaml"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/silverstripe/silverstripe-framework"
    },
    {
      "type": "WEB",
      "url": "https://www.silverstripe.org/software/download/security-releases/ss-2015-014"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "SilverStripe Vulnerability on \u0027isDev\u0027, \u0027isTest\u0027 and \u0027flush\u0027 $_GET validation"
}

GHSA-G4QR-PVVG-9H2W

Vulnerability from github – Published: 2022-07-07 00:00 – Updated: 2022-07-15 00:00
VLAI
Details

this vulnerability affect user that even not allowed to access via the web interface. First of all, the attacker needs to access the "Login menu - demo site" then he can see in this menu all the functionality of the application. If the attacker will try to click on one of the links, he will get an answer that he is not authorized because he needs to log in with credentials. after he performed log in to the system there are some functionalities that the specific user is not allowed to perform because he was configured with low privileges however all the attacker need to do in order to achieve his goals is to change the value of the prog step parameter from 0 to 1 or more and then the attacker could access to some of the functionality the web application that he couldn't perform it before the parameter changed.

Severity
6.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2022-23173"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-07-06T14:15:00Z",
    "severity": "MODERATE"
  },
  "details": "this vulnerability affect user that even not allowed to access via the web interface. First of all, the attacker needs to access the \"Login menu - demo site\" then he can see in this menu all the functionality of the application. If the attacker will try to click on one of the links, he will get an answer that he is not authorized because he needs to log in with credentials. after he performed log in to the system there are some functionalities that the specific user is not allowed to perform because he was configured with low privileges however all the attacker need to do in order to achieve his goals is to change the value of the prog step parameter from 0 to 1 or more and then the attacker could access to some of the functionality the web application that he couldn\u0027t perform it before the parameter changed.",
  "id": "GHSA-g4qr-pvvg-9h2w",
  "modified": "2022-07-15T00:00:16Z",
  "published": "2022-07-07T00:00:26Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-23173"
    },
    {
      "type": "WEB",
      "url": "https://www.gov.il/en/Departments/faq/cve_advisories"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    }
  ]
}
Mitigation
Architecture and Design

For each and every data access, ensure that the user has sufficient privilege to access the record that is being requested.

Mitigation
Architecture and Design Implementation

Make sure that the key that is used in the lookup of a specific user's record is not controllable externally by the user or that any tampering can be detected.

Mitigation
Architecture and Design

Use encryption in order to make it more difficult to guess other legitimate values of the key or associate a digital signature with the key so that the server can verify that there has been no tampering.

No CAPEC attack patterns related to this CWE.

← Back to the CWE list