WowRevenue <= 2.3.2 - Unauthenticated Insecure Direct Object Reference to Order Products via Campaign Shortcode 'order' Parameter
- ID
- WPSEC-2026-1821
- Plugin
- WowRevenue – Product Bundles & Bulk Discounts (revenue)
- Affected
- all versions before 3.1.0
- Remediation
- Update to 3.1.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-639
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-28
- Attack surface
- WowRevenue on WPSec AttackSurface
- Fix released
- Published
Description
The revenue plugin for WordPress is vulnerable to Insecure Direct Object Reference via the 'order' parameter in all versions up to, and including, 2.3.2. On the order-received (thank-you) page, the campaign shortcode loads whatever order ID is given in the 'order' query parameter and uses its first item as the product context, without checking the order key or that the visitor owns the order. This makes it possible for unauthenticated attackers to see the first purchased product of other customers' orders by enumerating order IDs, as long as a campaign shortcode that displays the context product (such as a volume discount campaign) is on the checkout page.
References
- https://wpsec.com/vuln/WPSEC-2026-1821/
- https://plugins.svn.wordpress.org/revenue/tags/3.1.0/
- https://wordpress.org/plugins/revenue/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS