Patchstack

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

For each and every data access, ensure that the user has sufficient privilege to access the record that is being requested.

Make sure that the key that is used in the lookup of a specific user's record is not controllable externally by the user or that any tampering can be detected.

Use encryption in order to make it more difficult to guess other legitimate values of the key or associate a digital signature with the key so that the server can verify that there has been no tampering.

Authorization Bypass Through User-Controlled Key

Authorization

Broken Access Control

Access Control Cheat Sheet

Authorization Testing Automation Cheat Sheet

Limit modification of access controls to specifically authorized actors/users

Cross-Site Request Forgery Prevention Cheat Sheet

Insecure Direct Object Reference Prevention Cheat Sheet

Protect API against unauthorized access/modification (IDOR)

Classify personal data regarding retention so that old or outdated data is deleted

MITRE CWE

MITRE CAPEC

OWASP Top 10

OWASP OpenCRE

Metasploit Framework

ProjectDiscovery nuclei-templates

Exploit-DB

PoC-in-GitHub

CVE Program CNA list

This vulnerability in Themeum's WP Crowdfunding plugin allows subscribers to bypass authorization controls via insecure direct object references (IDOR) by manipulating user-controlled keys. The issue affects versions before 2.2.1 and could lead to unauthorized access to sensitive data. The CVSS 3.1 vector indicates the attack requires network access with low complexity and privileges, no user interaction, and impacts confidentiality but not integrity or availability.

CVE Database V5

Detailed information about CVE-2026-73189: CWE-639 Authorization Bypass Through User-Controlled Key in Themeum WP Crowdfunding affecting Themeum WP Crowdfunding

CVE-2026-73189: CWE-639 Authorization Bypass Through User-Controlled Key in Themeum WP Crowdfunding - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2026-73189 has been rejected

Official rejection reason