CVE-2026-124652VulnerabilityPublished 12 Nov 2026

The Mine CloudVod WordPress plugin before 2.6.6 does not verify that an order belongs to the requesting user before

Source GCVE Database

Compare

Authoritative record:CVE-2026-124652· High

Not known to be exploited : upgrade to 2.6.6 soon.

Data as of 12 Nov 2026, 07:18 UTC

Severity

High

Rated High by Threat Radar's AI analysis · CVSS not yet scored by NVD

Thin evidence

One scorer or none

Patch: Available – fixed in 2.6.6

Exploitation evidence

Disclosed: evidence found.
CVE published 12 Nov 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 11 Nov 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

ghsa-3fmm-mc8g-m4mq

What to do

Upgrade Mine CloudVod (WordPress plugin) to 2.6.6.

Affected software

Product	Affected	Fixed in
Mine CloudVod	Affected <2.6.6	Fixed in 2.6.6

AI-suggested

A fix is available in Mine CloudVod plugin version 2.6.6. Users should upgrade to version 2.6.6 or later to ensure proper verification of order ownership before disclosing payment status information. No other mitigation steps are indicated.

Description

The Mine CloudVod WordPress plugin versions before 2.6.6 have a vulnerability where the plugin does not verify that an order belongs to the requesting user before disclosing its payment status. This flaw allows any authenticated user, including those with subscriber-level access, to view other customers' order statuses, purchased items, and, during an Alipay payment process, the buyer's Alipay account identifier.

Impact

Unauthorized authenticated users can access other customers' order statuses and purchased items, potentially exposing sensitive transaction details. Additionally, during an Alipay payment in progress, the vulnerability exposes the buyer's Alipay account identifier, which may lead to privacy violations or targeted attacks. There is no indication of remote code execution or privilege escalation, but the information disclosure can undermine customer privacy and trust.

Summary

The vulnerability in the Mine CloudVod WordPress plugin prior to version 2.6.6 involves insufficient authorization checks when returning order payment status information. Specifically, the plugin fails to verify ownership of an order before disclosing sensitive details such as order status, purchased items, and Alipay account identifiers to authenticated users. This can lead to unauthorized disclosure of customer order information to other authenticated users.

References

Community reviews

Loading reviews…