WordPress Plugin Vulnerabilities

WC Vendors < 2.7.2.1 - Vendor+ Cross-Vendor Product and Arbitrary Post Modification via IDOR

Description

The plugin does not verify ownership or the object type of user-supplied IDs when saving product variations, allowing authenticated users with the vendor role to modify product variations belonging to other vendors, and to change the status and title of arbitrary posts, via IDOR.

Proof of Concept

Affects Plugins

Plugin icon
wc-vendors
Fixed in 2.7.2.1

References

CVE
CVE-2026-81428

Classification

Type
IDOR
OWASP top 10
A5: Broken Access Control
CWE
CWE-639
CVSS
6.5 (medium)

Miscellaneous

Original Researcher
Usama Arshad
Submitter
Usama Arshad
Submitter website
https://www.usamaarshad.me/
Submitter twitter
usama0x01
Verified
Yes
WPVDB ID
e573c233-ed24-40a3-a16a-c80317910cce

Timeline

Publicly Published
2026-08-31 (about 2 days ago)
Added
2026-08-31 (about 1 day ago)
Last Updated
2026-08-31 (about 1 day ago)

Other

Published
Title
Published
2025-01-31
Title
WP Job Portal < 2.2.7 - Insecure Direct Object Reference to Authenticated (Employer+) Arbitrary Company Deletion
Published
2024-01-16
Title
Display custom fields in the frontend – Post and User Profile Fields < 1.3.0 - Insecure Direct Object Reference to Authenticated (Contributor+) Post Meta Disclosure
Published
2026-08-14
Title
WP Crowdfunding < 2.2.1 - Unauthenticated Insecure Direct Object Reference
Published
2026-03-11
Title
WpStream < 4.11.2 - Authenticated (Subscriber+) Insecure Direct Object Reference
Published
2022-04-14
Title
WP 2FA < 2.2.0 - Arbitrary 2FA Disabling via IDOR