CWE-639— Authorization Bypass Through User-Controlled Key (IDOR)

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.— MITRE CWE catalog

3,459 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-639page 64 of 70

CVE-2024-5942MEDIUMCVSS 4.3EG 4.3
2024-06-29
The Page and Post Clone plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.0 via the 'content_clone' function due to missing validation on a user controlled key. This makes it pos…
CVE-2024-4874MEDIUMCVSS 4.3EG 4.3
2024-06-22
The Bricks Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.9.8 via the postId parameter due to missing validation on a user controlled key. This makes it possible for a…
CVE-2024-5639MEDIUMCVSS 4.3EG 4.3
2024-06-21
The User Profile Picture plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.6.1 via the 'rest_api_change_profile_image' function due to missing validation on a user controlled key…
CVE-2024-4873MEDIUMCVSS 4.3EG 4.3
2024-06-19
The Replace Image plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.1.10 via the image replacement functionality due to missing validation on a user controlled key. This makes it…
CVE-2024-5438MEDIUMCVSS 4.3EG 4.3
2024-06-07
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.7.1 via the 'attempt_delete' function due to missing validation on a user…
CVE-2024-4886MEDIUMCVSS 4.3EG 4.3
2024-06-05
The contains an IDOR vulnerability that allows a user to comment on a private post by manipulating the ID included in the request
CVE-2024-4274MEDIUMCVSS 4.3EG 4.3
2024-06-04
The Essential Real Estate plugin for WordPress is vulnerable to unauthorized loss of data due to insufficient validation on the remove_property_attachment_ajax() function in all versions up to, and including, 4.4.2. This makes it possible …
CVE-2024-4843MEDIUMCVSS 4.3EG 4.3
2024-05-16
ePO doesn't allow a regular privileged user to delete tasks or assignments. Insecure direct object references that allow a least privileged user to manipulate the client task and client task assignments, hence escalating his/her privilege.
CVE-2024-4819MEDIUMCVSS 4.3EG 4.3
2024-05-14
A vulnerability was found in Campcodes Online Laundry Management System 1.0. It has been classified as problematic. Affected is an unknown function of the file admin_class.php. The manipulation of the argument type with the input 1 leads t…
CVE-2024-1693MEDIUMCVSS 4.3EG 4.3
2024-05-14
The SP Project & Document Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the cdm_save_category AJAX action in all versions up to, and including, 4.70. This makes it poss…
CVE-2024-33542MEDIUMCVSS 4.3EG 4.3
2024-04-29
Authorization Bypass Through User-Controlled Key vulnerability in Fabio Rinaldi Crelly Slider.This issue affects Crelly Slider: from n/a through 1.4.5.
CVE-2024-32772MEDIUMCVSS 4.3EG 4.3
2024-04-24
Authorization Bypass Through User-Controlled Key vulnerability in Metagauss ProfileGrid.This issue affects ProfileGrid : from n/a through 5.7.9.
CVE-2023-6897MEDIUMCVSS 4.3EG 4.3
2024-04-18
The EAN for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.9.2 via the the 'alg_wc_ean_product_meta' shortcode due to missing validation on a user controlled key. …
CVE-2024-32604MEDIUMCVSS 4.3EG 4.3
2024-04-18
Authorization Bypass Through User-Controlled Key vulnerability in Plechev Andrey WP-Recall.This issue affects WP-Recall: from n/a through 16.26.5.
CVE-2024-2543MEDIUMCVSS 4.3EG 4.3
2024-04-09
The Permalink Manager Lite plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'get_uri_editor' function in all versions up to, and including, 2.4.3.1. This makes it possible for unaut…
CVE-2024-2261MEDIUMCVSS 4.3EG 4.3
2024-04-09
The Event Tickets and Registration plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.8.2 via the RSVP functionality. This makes it possible for authenticated attackers, with contri…
CVE-2024-0872MEDIUMCVSS 4.3EG 4.3
2024-04-09
The Watu Quiz plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.4.1 via the watu-userinfo shortcode. This makes it possible for authenticated attackers, with contributor-level acce…
CVE-2024-31296MEDIUMCVSS 4.3EG 4.3
2024-04-07
Authorization Bypass Through User-Controlled Key vulnerability in Repute Infosystems BookingPress.This issue affects BookingPress: from n/a through 1.0.81.
CVE-2024-31291MEDIUMCVSS 4.3EG 4.3
2024-04-07
Authorization Bypass Through User-Controlled Key vulnerability in Metagauss ProfileGrid.This issue affects ProfileGrid : from n/a through 5.7.6.
CVE-2023-7198MEDIUMCVSS 4.3EG 4.3
2024-02-27
The WP Dashboard Notes WordPress plugin before 1.0.11 is vulnerable to Insecure Direct Object References (IDOR) in post_id= parameter. Authenticated users are able to delete private notes associated with different user accounts. This poses…
CVE-2024-0366MEDIUMCVSS 4.3EG 4.3
2024-02-05
The Starbox – the Author Box for Humans plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.4.7 via the action function due to missing validation on a user controlled key. This m…
CVE-2023-6983MEDIUMCVSS 4.3EG 4.3
2024-02-05
The Display custom fields in the frontend – Post and User Profile Fields plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.2.1 via the vg_display_data shortcode due to missing …
CVE-2023-6384MEDIUMCVSS 4.3EG 4.3
2024-01-22
The WP User Profile Avatar WordPress plugin before 1.0.1 does not properly check for authorisation, allowing authors to delete and update arbitrary avatar
CVE-2023-6504MEDIUMCVSS 4.3EG 4.3
2024-01-11
The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the wppb_toolbox_usermeta_handler funct…
CVE-2023-6506MEDIUMCVSS 4.3EG 4.3
2024-01-11
The WP 2FA – Two-factor authentication for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.5.0 via the send_backup_codes_email due to missing validation on a user c…
CVE-2023-6223MEDIUMCVSS 4.3EG 4.3
2024-01-11
The LearnPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.2.5.7 via the /wp-json/lp/v1/profile/course-tab REST API due to missing validation on the 'userID' user controlle…
CVE-2023-6630MEDIUMCVSS 4.3EG 4.3
2024-01-11
The Contact Form 7 – Dynamic Text Extension plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.1.0 via the CF7_get_custom_field and CF7_get_current_user shortcodes due to missin…
CVE-2023-50267MEDIUMCVSS 4.3EG 4.3
2023-12-28
MeterSphere is a one-stop open source continuous testing platform. Prior to 2.10.10-lts, the authenticated attackers can update resources which don't belong to him if the resource ID is known. This issue if fixed in 2.10.10-lts. There are…
CVE-2022-43450MEDIUMCVSS 4.3EG 4.3
2023-12-19
Authorization Bypass Through User-Controlled Key vulnerability in XWP Stream.This issue affects Stream: from n/a through 3.9.2.
CVE-2023-6226MEDIUMCVSS 4.3EG 4.3
2023-11-28
The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.13.3 via the su_meta shortcode due to missing validation on the user controlled…
CVE-2023-48304MEDIUMCVSS 4.3EG 4.3
2023-11-21
Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.11, 26.0.6, and 27.1.0 of Nextcloud Server and starting in version 22.0.0 and prior to versions 22.2…
CVE-2023-4836MEDIUMCVSS 4.3EG 4.3
2023-10-31
The WordPress File Sharing Plugin WordPress plugin before 2.0.5 does not check authorization before displaying files and folders, allowing users to gain access to those filed by manipulating IDs which can easily be brute forced
CVE-2023-3707MEDIUMCVSS 4.3EG 4.3
2023-10-16
The ActivityPub WordPress plugin before 1.0.0 does not ensure that post contents to be displayed are public and belong to the plugin, allowing any authenticated user, such as subscriber to retrieve the content of arbitrary post (such as dr…
CVE-2023-3706MEDIUMCVSS 4.3EG 4.3
2023-10-16
The ActivityPub WordPress plugin before 1.0.0 does not ensure that post titles to be displayed are public and belong to the plugin, allowing any authenticated user, such as subscriber to retrieve the title of arbitrary post (such as draft …
CVE-2023-2172MEDIUMCVSS 4.3EG 4.3
2023-08-31
The BadgeOS plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 3.7.1.6. This is due to improper validation and authorization checks within the badgeos_update_steps_ajax_handler, badgeos…
CVE-2023-0689MEDIUMCVSS 4.3EG 4.3
2023-08-31
The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mf_first_name' shortcode in versions up to, and including, 3.3.1. This allows authenticated attackers, with subscriber-level capabili…
CVE-2023-4036MEDIUMCVSS 4.3EG 4.3
2023-08-30
The Simple Blog Card WordPress plugin before 1.32 does not ensure that posts to be displayed via a shortcode are public, allowing any authenticated users, such as subscriber, to retrieve arbitrary post title and their content such as draft…
CVE-2023-4023MEDIUMCVSS 4.3EG 4.3
2023-08-30
The All Users Messenger WordPress plugin through 1.24 does not prevent non-administrator users from deleting messages from the all-users messenger.
CVE-2023-3601MEDIUMCVSS 4.3EG 4.3
2023-08-14
The Simple Author Box WordPress plugin before 2.52 does not verify a user ID before outputting information about that user, leading to arbitrary user information disclosure to users with a role as low as Contributor.
CVE-2023-30960MEDIUMCVSS 4.3EG 4.3
2023-07-10
A security defect was discovered in Foundry job-tracker that enabled users to query metadata related to builds on resources they did not have access to. This defect was resolved with the release of job-tracker 4.645.0. The service was roll…
CVE-2023-0692MEDIUMCVSS 4.3EG 4.3
2023-06-09
The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mf_payment_status' shortcode in versions up to, and including, 3.3.1. This allows authenticated attackers, with subscriber-level capa…
CVE-2023-0691MEDIUMCVSS 4.3EG 4.3
2023-06-09
The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mf_last_name' shortcode in versions up to, and including, 3.3.1. This allows authenticated attackers, with subscriber-level capabilit…
CVE-2023-33956MEDIUMCVSS 4.3EG 4.3
2023-06-05
Kanboard is open source project management software that focuses on the Kanban methodology. Versions prior to 1.2.30 are subject to an Insecure direct object reference (IDOR) vulnerability present in the application's URL parameter. This v…
CVE-2023-1911MEDIUMCVSS 4.3EG 4.3
2023-05-02
The Blocksy Companion WordPress plugin before 1.8.82 does not ensure that posts to be accessed via a shortcode are already public and can be viewed, allowing any authenticated users, such as subscriber to access draft posts for example
CVE-2023-1417MEDIUMCVSS 4.3EG 4.3
2023-04-05
An issue has been discovered in GitLab affecting all versions starting from 15.9 before 15.9.4, all versions starting from 15.10 before 15.10.1. It was possible for an unauthorised user to add child epics linked to victim's epic in an unre…
CVE-2023-28334MEDIUMCVSS 4.3EG 4.3
2023-03-23
Authenticated users were able to enumerate other users' names via the learning plans page.
CVE-2023-0453MEDIUMCVSS 4.3EG 4.3
2023-02-21
The WP Private Message WordPress plugin (bundled with the Superio theme as a required plugin) before 1.0.6 does not ensure that private messages to be accessed belong to the user making the requests. This allowing any authenticated users t…
CVE-2022-3995MEDIUMCVSS 4.3EG 4.3
2022-11-29
The TeraWallet plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 1.4.3. This is due to insufficient validation of the user-controlled key on the lock_unlock_terawallet AJAX action. Th…
CVE-2022-42129MEDIUMCVSS 4.3EG 4.3
2022-11-15
An Insecure direct object reference (IDOR) vulnerability in the Dynamic Data Mapping module in Liferay Portal 7.3.2 through 7.4.3.4, and Liferay DXP 7.3 before update 4, and 7.4 GA allows remote authenticated users to view and access form …
CVE-2022-3413MEDIUMCVSS 4.3EG 4.3
2022-11-10
Incorrect authorization during display of Audit Events in GitLab EE affecting all versions from 14.5 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2, allowed Developers to view the project's Audit Events and Developers or M…

Map vulnerabilities like CWE-639 to your infrastructure

EchelonGraph correlates every CVE — across CWE-639 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →