WordPress Plugin Vulnerabilities

License Manager for WooCommerce < 3.0.16 - Unauthenticated Insecure Direct Object Reference

Description

The License Manager for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.0.15 due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to perform unauthorized actions.

Affects Plugins

Plugin icon
license-manager-for-woocommerce
Fixed in 3.0.16

References

CVE
CVE-2026-56013
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/36ccce3e-7d96-4a80-843e-041bc194812c

Classification

Type
IDOR
OWASP top 10
A5: Broken Access Control
CWE
CWE-639
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
dodoh4t
Verified
No
WPVDB ID
19d0a227-7c66-4d4f-b9fd-815eb7b16b9d

Timeline

Publicly Published
2026-06-19 (about 3 months ago)
Added
2026-06-25 (about 3 months ago)
Last Updated
2026-06-25 (about 3 months ago)

Other

Published
Title
Published
2025-11-20
Title
Return Refund and Exchange For WooCommerce < 4.5.6 - Insecure Direct Object Reference to Authenticated (Subscriber+) Refund Request Cancellation
Published
2026-04-16
Title
My Calendar < 3.7.7 - Unauthenticated Denial of Service
Published
2023-12-29
Title
WP User Profile Avatar < 1.0.1 - Author+ Avatar Deletion/Update via IDOR
Published
2022-10-28
Title
Comments - wpDiscuz 7.4.2 - Subscriber+ IDOR
Published
2026-05-27
Title
Meta Field Block < 1.5.2 - Insecure Direct Object Reference to Authenticated (Contributor+) Arbitrary User Meta Exposure