WordPress Plugin Vulnerabilities

Starter Templates < 4.7.6 - Contributor+ IDOR

Description

The plugin is vulnerable to Insecure Direct Object Reference due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with contributor-level access and above, to perform an unauthorized action.

Affects Plugins

Plugin icon
astra-sites
Fixed in 4.7.6

References

CVE
CVE-2026-62134
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/a0acd462-2f0b-4ced-8a1a-960f9527d47e

Classification

Type
IDOR
OWASP top 10
A5: Broken Access Control
CWE
CWE-639
CVSS
2.7 (low)

Miscellaneous

Original Researcher
Ananda Dhakal
Verified
No
WPVDB ID
37f55e83-a6a6-423b-9fae-13dbfdcd3516

Timeline

Publicly Published
2026-09-10 (about 1 month ago)
Added
2026-09-16 (about 1 month ago)
Last Updated
2026-09-16 (about 1 month ago)

Other

Published
Title
Published
2026-03-30
Title
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor < 3.15.6 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Post Author Reassignment via Avatar Field
Published
2026-01-05
Title
Woffice Core < 5.4.31 - Unauthenticated Insecure Direct Object Reference
Published
2025-10-10
Title
WPC Smart Wishlist for WooCommerce < 5.0.4 - Insecure Direct Object Reference to Unauthenticated Wishlist Manipulation
Published
2026-07-02
Title
Ad Inserter < 2.8.17 - Insecure Direct Object Reference to Authenticated (Contributor+) Arbitrary Post Content Disclosure via 'data' Shortcode Attribute
Published
2023-04-10
Title
Ruby Help Desk < 1.3.4 - Subscriber+ Ticket Update via IDOR