WordPress Plugin Vulnerabilities

Miraculous Core < 2.0.9 - Unauthenticated Insecure Direct Object Reference

Description

The miraculouscore plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to 2.0.9 (exclusive) due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to perform an unauthorized action.

Affects Plugins

Plugin icon
miraculouscore
Fixed in 2.0.9

References

CVE
CVE-2025-58627
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/c460e742-1008-4334-971c-999107851d62

Classification

Type
IDOR
OWASP top 10
A5: Broken Access Control
CWE
CWE-639
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
0xd4rk5id3
Verified
No
WPVDB ID
0e5974e8-5a95-4aac-8068-8f34f61b29fe

Timeline

Publicly Published
2025-09-01 (about 7 months ago)
Added
2025-11-11 (about 4 months ago)
Last Updated
2025-11-11 (about 4 months ago)

Other

Published
Title
Published
2025-12-20
Title
WP JobHunt <= 7.7 - Authenticated (Candidate+) Insecure Direct Object Reference
Published
2023-10-09
Title
WordPress File Sharing Plugin < 2.0.5 - Subscriber+ Sensitive Data and Files Exposure via IDOR
Published
2022-04-14
Title
WP 2FA < 2.2.0 - Arbitrary 2FA Disabling via IDOR
Published
2025-03-24
Title
User Registration & Membership (Free < 4.1.2, Pro < 5.1.2) - Unauthenticated Privilege Escalation
Published
2026-01-02
Title
Tutor LMS < 3.9.5 - Authenticated (Instructor+) Insecure Direct Object Reference