~/research/tags/#IDOR

> #IDOR

2 RESEARCH ENTRIES

2026.07.30

CVE-2026-59557

Events Made Easy Arbitrary Person Record Modification Without Login

Broken access control in Events Made Easy <= 3.0.67 lets unauthenticated attackers modify arbitrary person records through the public personal-information AJAX endpoint.

Read Advisory SECREPORT

#CVE #WordPress #Broken Access Control #IDOR

2026.06.22

CVE-2026-54826

SupportCandy Attachment IDOR via Thread Endpoint

IDOR in SupportCandy <= 3.4.6 lets a low-privilege user reassign and download another user's private ticket attachments via the thread-creation endpoint.

Read Advisory SECREPORT

#CVE #WordPress #IDOR