WordPress Plugin Vulnerabilities

Product Slider, Product Grid, Product Masonry < 1.13.63 - Authenticated (Contributor+) Insecure Direct Object Reference

Description

The Product Slider, Product Grid, Product Masonry plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.13.62 due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Contributor-level access and above, to perform an unauthorized action.

Affects Plugins

Plugin icon
woocommerce-products-slider
Fixed in 1.13.63

References

CVE
CVE-2026-65456
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/49275353-4f8a-4110-aaa1-1c7612fa3ce5

Classification

Type
IDOR
OWASP top 10
A5: Broken Access Control
CWE
CWE-639
CVSS
2.7 (Low)

Miscellaneous

Original Researcher
Ananda Dhakal
Verified
No
WPVDB ID
e1bd3747-fba1-4c67-8596-61bde1b53c6c

Timeline

Publicly Published
2026-07-22 (about 1 month ago)
Added
2026-07-29 (about 1 month ago)
Last Updated
2026-07-29 (about 1 month ago)

Other

Published
Title
Published
2025-02-03
Title
Medical Addon for Elementor < 1.6.3 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Exposure via Shortcode
Published
2026-03-23
Title
JS Help Desk – AI-Powered Support & Ticketing System < 3.0.4 - Authenticated (Subscriber+) Insecure Direct Object Reference
Published
2026-06-16
Title
Clean Login < 1.16 - Unauthenticated Insecure Direct Object Reference
Published
2024-07-18
Title
GiveWP – Donation Plugin and Fundraising Platform < 3.14.0 - Insecure Direct Object Reference to Authenticated (GiveWP Worker+) Arbitrary Post Actions
Published
2026-08-17
Title
SmartCrawl < 3.16.3 - Subscriber+ Private/Draft Post Title Disclosure and Post Meta Key Enumeration