WordPress Plugin Vulnerabilities

Maya Business < 1.3.0 - Unauthenticated Insecure Direct Object Reference

Description

The Maya Business Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.2.0 due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to perform an unauthorized action.

Affects Plugins

Plugin icon
paymaya-checkout-for-woocommerce
Fixed in 1.3.0

References

CVE
CVE-2025-53208
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/8304037f-6d04-4df1-987f-fd62cfec00b3

Classification

Type
IDOR
OWASP top 10
A5: Broken Access Control
CWE
CWE-639
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
ch4r0n
Verified
No
WPVDB ID
cc8d02ec-fb35-4050-a024-6169c4c7b5cd

Timeline

Publicly Published
2025-07-16 (about 1 year ago)
Added
2025-07-22 (about 1 year ago)
Last Updated
2025-07-22 (about 1 year ago)

Other

Published
Title
Published
2025-12-03
Title
HUSKY – Products Filter Professional for WooCommerce < 1.3.7.3 - Authenticated (Subscriber+) Insecure Direct Object Reference via 'woof_add_query/woof_remove_query'
Published
2025-01-14
Title
Piotnet Addons For Elementor < 2.4.33 - Authenticated (Contributor+) Post Disclosure
Published
2026-07-13
Title
BuddyPress < 14.5.0 - Subscriber+ Private Messages Disclosure via IDOR
Published
2024-11-25
Title
The Events Calendar < 6.8.2.1 - Unauthenticated Password Protected Event Disclosure
Published
2023-07-10
Title
WooCommerce GoCardless Gateway < 2.5.7 - Unauthenticated Sensitive Information Disclosure