Common Weakness Enumeration

CWE-639

Allowed

Authorization Bypass Through User-Controlled Key

Abstraction: Base · Status: Incomplete

API response cwe.mitre.org

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

5323 vulnerabilities reference this CWE, most recent first.

GHSA-HR9V-R8R2-HG7J

Vulnerability from github – Published: 2026-06-05 20:35 – Updated: 2026-06-05 20:35
VLAI
Summary
Shopper: Multiple data integrity and disclosure issues in admin Livewire components
Details

Impact

Three related defects on admin Livewire components allowed data tampering, sensitive data disclosure, and stored XSS:

  • IDOR via unlocked properties. Several Livewire components in the admin panel exposed Eloquent model identifiers as public properties without the #[Locked] attribute. An authenticated user could rewrite the wire payload from the browser to target any record id, bypassing the implicit scoping enforced by the page routing.
  • Sensitive data echoed back through Hidden form field. Customers/Create::store() re-passed a Hidden _password form field straight into the create payload. The plaintext password was rendered into the HTML and transported through the Livewire snapshot in clear text, exposing credentials in the page DOM and in any logging that captures Livewire payloads.
  • Stored XSS on product barcode. The product barcode field was rendered through DNS1DFacade::getBarcodeHTML() with {!! !!}. An attacker with edit_products permission could persist malicious payload in the barcode field that would execute in the browser of any admin user viewing that product, enabling session theft and privileged-action chaining.

Patches

Fixed in v2.8.0:

  • All vulnerable Livewire model identifiers are now marked #[Locked].
  • Customers/Create no longer round-trips the password through a Hidden form field; the plaintext password is hashed at action boundary and never returned to the client.
  • The product barcode rendering now escapes the value before passing it to the barcode generator and the output is wrapped in an <svg> context that does not interpret event handlers.

Upgrade via:

composer require shopper/admin:^2.8

Workarounds

None. Upgrade to v2.8.0.

Severity
8.7 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "shopper/framework"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.8.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-47743"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-200",
      "CWE-639",
      "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-05T20:35:14Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "## Impact\n\nThree related defects on admin Livewire components allowed data tampering, sensitive data disclosure, and stored XSS:\n\n- **IDOR via unlocked properties.** Several Livewire components in the admin panel exposed Eloquent model identifiers as public properties without the `#[Locked]` attribute. An authenticated user could rewrite the wire payload from the browser to target any record id, bypassing the implicit scoping enforced by the page routing.\n- **Sensitive data echoed back through Hidden form field.** `Customers/Create::store()` re-passed a `Hidden` `_password` form field straight into the create payload. The plaintext password was rendered into the HTML and transported through the Livewire snapshot in clear text, exposing credentials in the page DOM and in any logging that captures Livewire payloads.\n- **Stored XSS on product barcode.** The product barcode field was rendered through `DNS1DFacade::getBarcodeHTML()` with `{!! !!}`. An attacker with `edit_products` permission could persist malicious payload in the barcode field that would execute in the browser of any admin user viewing that product, enabling session theft and privileged-action chaining.\n\n## Patches\n\nFixed in `v2.8.0`:\n\n- All vulnerable Livewire model identifiers are now marked `#[Locked]`.\n- `Customers/Create` no longer round-trips the password through a Hidden form field; the plaintext password is hashed at action boundary and never returned to the client.\n- The product barcode rendering now escapes the value before passing it to the barcode generator and the output is wrapped in an `\u003csvg\u003e` context that does not interpret event handlers.\n\nUpgrade via:\n\n```bash\ncomposer require shopper/admin:^2.8\n```\n\n## Workarounds\n\nNone. Upgrade to `v2.8.0`.",
  "id": "GHSA-hr9v-r8r2-hg7j",
  "modified": "2026-06-05T20:35:14Z",
  "published": "2026-06-05T20:35:14Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/shopperlabs/shopper/security/advisories/GHSA-hr9v-r8r2-hg7j"
    },
    {
      "type": "WEB",
      "url": "https://github.com/shopperlabs/shopper/pull/511"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/shopperlabs/shopper"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Shopper: Multiple data integrity and disclosure issues in admin Livewire components"
}

GHSA-HRR2-8G8J-2H2H

Vulnerability from github – Published: 2026-06-12 21:31 – Updated: 2026-06-12 21:31
VLAI
Details

A flaw in Naxclow's platform’s onboarding workflow allows an attacker to replay a confirm-then-bind sequence to silently reassign a device to an arbitrary account. Because the affected endpoints validate request signatures but do not confirm legitimate ownership, an attacker with any account can take over a device without user interaction while the device remains online and unaware.

Severity
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
8.7 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-42947"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-06-12T19:16:27Z",
    "severity": "HIGH"
  },
  "details": "A flaw in Naxclow\u0027s platform\u2019s onboarding workflow allows an attacker to replay a confirm-then-bind sequence to silently reassign a device to an arbitrary account. Because the affected endpoints validate request signatures but do not confirm legitimate ownership, an attacker with any account can take over a device without user interaction while the device remains online and unaware.",
  "id": "GHSA-hrr2-8g8j-2h2h",
  "modified": "2026-06-12T21:31:44Z",
  "published": "2026-06-12T21:31:44Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42947"
    },
    {
      "type": "WEB",
      "url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-162-02.json"
    },
    {
      "type": "WEB",
      "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-162-02"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-HRWW-75RF-PH52

Vulnerability from github – Published: 2026-10-07 21:33 – Updated: 2026-10-07 21:33
VLAI
Details

In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user who does not hold the "admin" or "power" Splunk roles could use a user-controlled job identifier to access substantially all search job information from jobs that belong to other users, including search query text, job metadata, results, and preview results, through an Application Programming Interface (API) implemented as a Representational State Transfer (REST) API. The vulnerability is possible because the REST API does not fully validate job ownership before returning search job information.

Severity
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-76269"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-10-07T21:17:17Z",
    "severity": "MODERATE"
  },
  "details": "In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user who does not hold the \"admin\" or \"power\" Splunk roles could use a user-controlled job identifier to access substantially all search job information from jobs that belong to other users, including search query text, job metadata, results, and preview results, through an Application Programming Interface (API) implemented as a Representational State Transfer (REST) API. The vulnerability is possible because the REST API does not fully validate job ownership before returning search job information.",
  "id": "GHSA-hrww-75rf-ph52",
  "modified": "2026-10-07T21:33:30Z",
  "published": "2026-10-07T21:33:30Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-76269"
    },
    {
      "type": "WEB",
      "url": "https://advisory.splunk.com/advisories/SVD-2026-1001"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-HRXV-M5X6-XFPV

Vulnerability from github – Published: 2026-10-21 06:31 – Updated: 2026-10-21 12:31
VLAI
Details

The Kliken: Ads + Pixel for Meta WordPress plugin before 1.2.3 does not verify that a visitor holds an order's key before outputting that order's details on the order confirmation page, allowing unauthenticated users to retrieve the billing location, purchased products and totals of other customers' orders by enumerating order IDs.

Severity
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-111596"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-10-21T06:16:48Z",
    "severity": "MODERATE"
  },
  "details": "The Kliken: Ads + Pixel for Meta WordPress plugin before 1.2.3 does not verify that a visitor holds an order\u0027s key before outputting that order\u0027s details on the order confirmation page, allowing unauthenticated users to retrieve the billing location, purchased products and totals of other customers\u0027 orders by enumerating order IDs.",
  "id": "GHSA-hrxv-m5x6-xfpv",
  "modified": "2026-10-21T12:31:05Z",
  "published": "2026-10-21T06:31:15Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111596"
    },
    {
      "type": "WEB",
      "url": "https://wpscan.com/vulnerability/8bba9959-9c7a-4564-bcba-fc34a922ecc7"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-HV93-R4J3-Q65F

Vulnerability from github – Published: 2026-02-17 16:43 – Updated: 2026-02-17 16:43
VLAI
Summary
OpenClaw Hook Session Key Override Enables Targeted Cross-Session Routing
Details

Summary

The issue is not deterministic session keys by itself. The exploitable path was accepting externally supplied sessionKey values on authenticated hook ingress, allowing a hook token holder to route messages into chosen sessions.

Affected Behavior

  • POST /hooks/agent accepted payload sessionKey and used it directly for session routing.
  • Common session-key shapes (for example agent:main:dm:<peerId>) were often derivable from known metadata, making targeted routing practical when request-level override was enabled.

Attack Preconditions

  • Attacker can call hook endpoints with a valid hook token.
  • Hook ingress allows request-selected sessionKey values.
  • Target session keys can be derived or guessed.

Without those preconditions, deterministic key formats alone do not provide access.

Impact

  • Integrity: targeted message/prompt injection into chosen sessions.
  • Persistence: poisoned context can affect subsequent turns when the same session key is reused.
  • Confidentiality impact is secondary and depends on additional weaknesses.

Affected Versions

  • openclaw >= 2.0.0-beta3 and < 2026.2.12

Patched Versions

  • openclaw >= 2026.2.12

Fix

OpenClaw now uses secure defaults for hook session routing: - POST /hooks/agent rejects payload sessionKey unless hooks.allowRequestSessionKey=true. - Added hooks.defaultSessionKey for fixed ingress routing. - Added hooks.allowedSessionKeyPrefixes to constrain explicit routing keys. - Security audit warns on unsafe hook session-routing settings.

Recommended Configuration

{
  "hooks": {
    "enabled": true,
    "token": "${OPENCLAW_HOOKS_TOKEN}",
    "defaultSessionKey": "hook:ingress",
    "allowRequestSessionKey": false,
    "allowedSessionKeyPrefixes": ["hook:"]
  }
}

Credit

Thanks @alpernae for responsible reporting.

Severity
7.1 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "openclaw"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.0.0-beta3"
            },
            {
              "fixed": "2026.2.12"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-330",
      "CWE-639"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-02-17T16:43:34Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "## Summary\nThe issue is not deterministic session keys by itself. The exploitable path was accepting externally supplied `sessionKey` values on authenticated hook ingress, allowing a hook token holder to route messages into chosen sessions.\n\n## Affected Behavior\n- `POST /hooks/agent` accepted payload `sessionKey` and used it directly for session routing.\n- Common session-key shapes (for example `agent:main:dm:\u003cpeerId\u003e`) were often derivable from known metadata, making targeted routing practical when request-level override was enabled.\n\n## Attack Preconditions\n- Attacker can call hook endpoints with a valid hook token.\n- Hook ingress allows request-selected `sessionKey` values.\n- Target session keys can be derived or guessed.\n\nWithout those preconditions, deterministic key formats alone do not provide access.\n\n## Impact\n- Integrity: targeted message/prompt injection into chosen sessions.\n- Persistence: poisoned context can affect subsequent turns when the same session key is reused.\n- Confidentiality impact is secondary and depends on additional weaknesses.\n\n## Affected Versions\n- `openclaw` `\u003e= 2.0.0-beta3` and `\u003c 2026.2.12`\n\n## Patched Versions\n- `openclaw` `\u003e= 2026.2.12`\n\n## Fix\nOpenClaw now uses secure defaults for hook session routing:\n- `POST /hooks/agent` rejects payload `sessionKey` unless `hooks.allowRequestSessionKey=true`.\n- Added `hooks.defaultSessionKey` for fixed ingress routing.\n- Added `hooks.allowedSessionKeyPrefixes` to constrain explicit routing keys.\n- Security audit warns on unsafe hook session-routing settings.\n\n## Recommended Configuration\n```json\n{\n  \"hooks\": {\n    \"enabled\": true,\n    \"token\": \"${OPENCLAW_HOOKS_TOKEN}\",\n    \"defaultSessionKey\": \"hook:ingress\",\n    \"allowRequestSessionKey\": false,\n    \"allowedSessionKeyPrefixes\": [\"hook:\"]\n  }\n}\n```\n\n## Credit\nThanks @alpernae for responsible reporting.",
  "id": "GHSA-hv93-r4j3-q65f",
  "modified": "2026-02-17T16:43:34Z",
  "published": "2026-02-17T16:43:34Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-hv93-r4j3-q65f"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openclaw/openclaw/commit/113ebfd6a23c4beb8a575d48f7482593254506ec"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/openclaw/openclaw"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openclaw/openclaw/releases/tag/v2026.2.12"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "OpenClaw Hook Session Key Override Enables Targeted Cross-Session Routing"
}

GHSA-HV9X-X7P8-5XPF

Vulnerability from github – Published: 2026-10-13 15:32 – Updated: 2026-10-13 15:32
VLAI
Details

EspoCRM before 10.0.7 contains an insecure direct object reference vulnerability that allows authenticated users with Import scope access to read other users' attachments by supplying a foreign attachmentId to the Import endpoint. Attackers can create an Import record referencing a known attachment ID, then call the error export endpoint to copy source rows into a downloadable CSV they own.

Severity
4.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
5.3 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-109957"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-10-13T14:17:34Z",
    "severity": "MODERATE"
  },
  "details": "EspoCRM before 10.0.7 contains an insecure direct object reference vulnerability that allows authenticated users with Import scope access to read other users\u0027 attachments by supplying a foreign attachmentId to the Import endpoint. Attackers can create an Import record referencing a known attachment ID, then call the error export endpoint to copy source rows into a downloadable CSV they own.",
  "id": "GHSA-hv9x-x7p8-5xpf",
  "modified": "2026-10-13T15:32:23Z",
  "published": "2026-10-13T15:32:23Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/espocrm/espocrm/security/advisories/GHSA-5729-xq64-4h22"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109957"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/espocrm-before-10.0.7-idor-via-import-attachmentid-parameter"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-HVQP-VJWF-27JG

Vulnerability from github – Published: 2026-05-22 09:31 – Updated: 2026-05-22 09:31
VLAI
Details

The AudioIgniter plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 2.0.2. This is due to the handle_playlist_endpoint() function (hooked to template_redirect) accepting a user-controlled playlist ID via the audioigniter_playlist_id query var or the /audioigniter/playlist/{id}/ rewrite rule and returning playlist track data without performing any authentication, capability, or post_status check — only the post_type is validated. This makes it possible for unauthenticated attackers to view track metadata (titles, artists, audio URLs, buy links, download URLs, and cover images) of any playlist on the site, including those in draft, private, pending, or trash status.

Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-8679"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-05-22T09:16:32Z",
    "severity": "HIGH"
  },
  "details": "The AudioIgniter plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 2.0.2. This is due to the handle_playlist_endpoint() function (hooked to template_redirect) accepting a user-controlled playlist ID via the audioigniter_playlist_id query var or the /audioigniter/playlist/{id}/ rewrite rule and returning playlist track data without performing any authentication, capability, or post_status check \u2014 only the post_type is validated. This makes it possible for unauthenticated attackers to view track metadata (titles, artists, audio URLs, buy links, download URLs, and cover images) of any playlist on the site, including those in draft, private, pending, or trash status.",
  "id": "GHSA-hvqp-vjwf-27jg",
  "modified": "2026-05-22T09:31:28Z",
  "published": "2026-05-22T09:31:28Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8679"
    },
    {
      "type": "WEB",
      "url": "https://github.com/cssigniter/audioigniter/commit/35a0508583c26c01b6ac446404ad6fe1d440d8d4"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/audioigniter/tags/2.0.2/audioigniter.php#L1257"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/audioigniter/tags/2.0.2/audioigniter.php#L1263"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/audioigniter/tags/2.0.2/audioigniter.php#L1315"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/fe573d64-036e-4f6f-bcc1-5183bb9ad2b9?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-HVVG-F9H2-W3P3

Vulnerability from github – Published: 2024-11-09 06:30 – Updated: 2024-11-09 06:30
VLAI
Details

The Content Slider Block plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 3.1.5 via the [csb] shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from password protected, private, or draft posts that they should not have access to.

Severity
4.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2024-10667"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-11-09T05:15:07Z",
    "severity": "MODERATE"
  },
  "details": "The Content Slider Block plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 3.1.5 via the [csb] shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from password protected, private, or draft posts that they should not have access to.",
  "id": "GHSA-hvvg-f9h2-w3p3",
  "modified": "2024-11-09T06:30:25Z",
  "published": "2024-11-09T06:30:25Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10667"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/changeset/3180314/content-slider-block/tags/3.1.6/includes/CustomPost.php?old=3178657\u0026old_path=content-slider-block%2Ftags%2F3.1.5%2Fincludes%2FCustomPost.php"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c34ca97f-d974-4ad1-b4a5-93613eb43a37?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-HW85-HP8P-J3G9

Vulnerability from github – Published: 2024-01-16 18:31 – Updated: 2024-10-22 18:32
VLAI
Details

The WP Customer Area WordPress plugin before 8.2.1 does not properly validates user capabilities in some of its AJAX actions, allowing any users to retrieve other user's account address.

Severity
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2023-6824"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-01-16T16:15:13Z",
    "severity": "MODERATE"
  },
  "details": "The WP Customer Area WordPress plugin before 8.2.1 does not properly validates user capabilities in some of its AJAX actions, allowing any users to retrieve other user\u0027s account address.",
  "id": "GHSA-hw85-hp8p-j3g9",
  "modified": "2024-10-22T18:32:04Z",
  "published": "2024-01-16T18:31:10Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-6824"
    },
    {
      "type": "WEB",
      "url": "https://wpscan.com/vulnerability/a224b984-770a-4534-b689-0701b582b388"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-HW9J-MG68-R593

Vulnerability from github – Published: 2024-04-07 18:30 – Updated: 2025-03-20 12:32
VLAI
Details

Authorization Bypass Through User-Controlled Key vulnerability in Repute Infosystems BookingPress.This issue affects BookingPress: from n/a through 1.0.81.

Severity
4.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2024-31296"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-04-07T18:15:11Z",
    "severity": "MODERATE"
  },
  "details": "Authorization Bypass Through User-Controlled Key vulnerability in Repute Infosystems BookingPress.This issue affects BookingPress: from n/a through 1.0.81.",
  "id": "GHSA-hw9j-mg68-r593",
  "modified": "2025-03-20T12:32:37Z",
  "published": "2024-04-07T18:30:30Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-31296"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/vulnerability/bookingpress-appointment-booking/wordpress-bookingpress-plugin-1-0-81-insecure-direct-object-references-idor-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}
Mitigation
Architecture and Design

For each and every data access, ensure that the user has sufficient privilege to access the record that is being requested.

Mitigation
Architecture and Design Implementation

Make sure that the key that is used in the lookup of a specific user's record is not controllable externally by the user or that any tampering can be detected.

Mitigation
Architecture and Design

Use encryption in order to make it more difficult to guess other legitimate values of the key or associate a digital signature with the key so that the server can verify that there has been no tampering.

No CAPEC attack patterns related to this CWE.

← Back to the CWE list