WordPress Plugin Vulnerabilities

WPCasa < 1.3.0 - Insecure Direct Object Reference

Description

The WPCasa plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.2.13 due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to act on objects they shouldn't be able to manipulate.

Affects Plugins

Plugin icon
wpcasa
Fixed in 1.3.0

References

CVE
CVE-2024-53826
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/5d1e5030-fb78-47da-b571-048b97c9ff9e

Classification

Type
IDOR
OWASP top 10
A5: Broken Access Control
CWE
CWE-639
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Manab Jyoti Dowarah
Verified
No
WPVDB ID
e17820d9-26e5-4404-8ebb-c6285e8f1669

Timeline

Publicly Published
2024-12-02 (about 1 year ago)
Added
2024-12-12 (about 1 year ago)
Last Updated
2024-12-12 (about 1 year ago)

Other

Published
Title
Published
2025-12-31
Title
Master Addons for Elementor < 2.1.0 - Unauthenticated Insecure Direct Object Reference
Published
2026-08-15
Title
Password Protect WordPress Lite < 1.9.21 - Insecure Direct Object Reference to Authenticated (Contributor+) Password Protected Post Password Update
Published
2024-04-16
Title
WP-Recall – Registration, Profile, Commerce & More < 16.26.6 - Insecure Direct Object Reference
Published
2026-07-08
Title
Hydra Booking < 1.2.2 - Authenticated (Custom+) Insecure Direct Object Reference to Sensitive Information Exposure via 'booking_id' Parameter
Published
2026-09-03
Title
Accept Stripe Payments < 2.1.4 - Unauthenticated Product Substitution via IDOR