CWE-639: Insecure Direct Object Reference vulnerabilities

The Appointment Booking Plugin – LatePoint for WordPress versions up to 5.7.3 contains an authorization bypass vulnerability due to insecure direct object references in certain public AJAX routes. Unauthenticated attackers can enumerate booking and cart IDs to access other users' appointment details and pending checkout information without ownership verification.

CVE-2026-110467 is an authorization bypass vulnerability in WisdomGarden's Tronclass product. Authenticated remote attackers can exploit an insecure direct object reference (CWE-639) by modifying a user-controlled parameter to access peer review scores of any student. The vulnerability affects versions 1.77 and 1.78. The CVSS 4.0 base score is 5.3, indicating medium severity. No patch or vendor advisory is currently provided, and no known exploits are reported in the wild.

WisdomGarden's Tronclass versions 1.77 and 1.78 contain an insecure direct object reference vulnerability (CWE-639) that allows authenticated remote attackers with low privileges to modify a parameter and alter peer review scores of any student. The vulnerability has a medium severity with a CVSS 4.0 base score of 5.3. There is no indication of known exploits in the wild or available patches at this time.

CVE-2026-96900 is a medium severity vulnerability in the Cart Abandonment Recovery for WooCommerce WordPress plugin before version 2.1.4. The flaw allows unauthenticated attackers who know a customer's email address to delete or modify that customer's abandoned cart data without verifying ownership of the email. This can lead to unauthorized tampering with user data stored by the plugin.

CVE-2026-94261 is a medium severity vulnerability in the Sifalo Pay WordPress plugin before version 2.5.3. It allows unauthenticated attackers who possess a valid payment transaction identifier from their own payment to mark arbitrary pending orders as paid. This occurs because the plugin does not verify that the payment transaction identifier belongs to the order it is confirming, nor does it verify that the requester owns the order.

CVE-2026-88927 is a medium severity vulnerability in the rtMedia plugin for WordPress, BuddyPress, and bbPress versions before 4.7.14. It allows users with subscriber-level or higher accounts to upload media into private albums owned by other users without proper authorization checks. This flaw arises because the plugin does not verify ownership or write permissions for the album to which media is assigned.

CVE-2026-108066 is a low-severity vulnerability in the WP 2FA WordPress plugin versions before 4.2.0. It allows a site administrator on WordPress Multisite installations to remove the two-factor authentication (2FA) configuration of users outside their own site without proper authorization checks. This bypasses object-level capability checks and crosses a trust boundary specific to Multisite environments. Single-site installations are not affected in this way since administrators can already manage all users.

GamiPress WordPress plugin versions before 8.0.6 contain an authorization bypass vulnerability. This flaw allows any authenticated user, including those with minimal privileges such as Subscribers, to access arbitrary entries in the activity log without proper capability or ownership checks. The exposed information includes other users' points balances, earned achievements, and usernames of administrators who manually awarded or revoked points.

NEX-Forms WordPress plugin versions from 9.2.1 up to but not including 9.3.1 contain an authorization bypass vulnerability. This flaw allows unauthenticated attackers to update stored form entries without any authorization or ownership checks by referencing their sequential identifiers. The vulnerability can lead to unauthorized modification, deletion, or reassignment of form entries.

Abandoned Cart Pro for WooCommerce plugin versions up to and including 10.8.0 suffer from an authentication bypass vulnerability due to insecure encryption and HMAC implementation. Attackers can exploit this flaw to forge cart-recovery tokens and gain unauthorized access to any user's account, including administrators. The vulnerability arises from the use of MAC-free AES-CTR encryption with a user-controlled key and an HMAC check that can be bypassed by omitting a parameter. The plugin's auto-login feature is enabled by default and forced on during upgrades, increasing exploitability.

The Database Addon for Contact Form 7 – CFDB7 WordPress plugin versions up to 1.4.1 contains an authorization bypass vulnerability that allows unauthenticated attackers to delete arbitrary files. This occurs because the plugin stores arbitrary submission fields and uses a delete handler that deletes files based on stored keys containing 'cfdb7_file' without proper validation. The vulnerability has a medium severity rating with a CVSS score of 5.3.

CVE-2026-15468 is an authorization bypass vulnerability in HYPR Passwordless on Windows that allows privilege escalation. It affects versions prior to 11.3.3. The vulnerability arises from a user-controlled key that can be exploited to bypass authorization checks.

CVE-2026-16753 is an incorrect authorization vulnerability in Lowcoder versions 2.1.0 through 2.4.10. It allows an authenticated administrator or developer from one organization to execute library queries belonging to another organization by crafting a request with the victim's library-query identifier. This flaw affects the library-query execution endpoint and can lead to unauthorized access and execution of queries across organizational boundaries.

CVE-2026-104875 is an authorization bypass vulnerability in Ente's server versions prior to 0.1.18 and image 2026.07.09. It affects the emergency contact recovery approval process, allowing an accepted emergency contact to misuse the approval endpoint by submitting their own identifier to prematurely change the victim's recovery session state and access recovery information before the configured notice period ends. Similar insufficient authorization checks also affect reject and stop recovery transitions, potentially enabling unauthorized cancellation of recovery sessions. The vulnerability requires the attacker to already be an accepted emergency contact and does not grant recovery rights for arbitrary accounts. The issue is fixed in versions 0.1.18 and 2026.07.09.

Improper authorization in Skype for Business and Microsoft Lync allows an authorized attacker to elevate privileges over a network.

Protection mechanism failure in Windows PowerShell allows an authorized attacker to bypass a security feature locally.

Plane, an open-source project management tool, has a vulnerability prior to version 1.4.0 where unauthenticated GET requests to a specific API endpoint expose secret invitation tokens. This allows an attacker to retrieve invitation tokens intended for other users and join workspaces without an invitation, gaining assigned roles. The issue is fixed in version 1.4.0.

A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly restrict access to database queries used for subnet management. This could allow an authenticated attacker to read, modify, or delete subnet configurations, leading to unauthorized information disclosure and data manipulation.

CVE-2026-89202 is a medium severity vulnerability in Siemens RUGGEDCOM CROSSBOW affecting all versions prior to 6.0. The flaw involves improper authorization checks on device disconnection requests, allowing an authenticated user with minimal privileges to disconnect active sessions of other users, including administrators. This can result in a denial of service by disrupting legitimate user sessions.

A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly restrict access to sensitive configuration items via specific database queries. This could allow an authenticated attacker to retrieve administrative credentials for various internal systems, leading to unauthorized information disclosure and privilege escalation.