Tag: IDOR (2 posts)

CVE

CVE-2026-59557 - Events Made Easy Arbitrary Person Record Modification Without Login

Broken access control in Events Made Easy <= 3.0.67 lets unauthenticated attackers modify arbitrary person records through the public personal-information AJAX endpoint.

Read

CVE WordPress Broken Access Control IDOR

CVE

CVE-2026-54826 - SupportCandy Attachment IDOR via Thread Endpoint

IDOR in SupportCandy <= 3.4.6 lets a low-privilege user reassign and download another user's private ticket attachments via the thread-creation endpoint.

Read

CVE WordPress IDOR