{
 "id": "WPSEC-2026-1821",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1821/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1821/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1821/index.md",
 "title": "WowRevenue <= 2.3.2 - Unauthenticated Insecure Direct Object Reference to Order Products via Campaign Shortcode 'order' Parameter",
 "description": "The revenue plugin for WordPress is vulnerable to Insecure Direct Object Reference via the 'order' parameter in all versions up to, and including, 2.3.2. On the order-received (thank-you) page, the campaign shortcode loads whatever order ID is given in the 'order' query parameter and uses its first item as the product context, without checking the order key or that the visitor owns the order. This makes it possible for unauthenticated attackers to see the first purchased product of other customers' orders by enumerating order IDs, as long as a campaign shortcode that displays the context product (such as a volume discount campaign) is on the checkout page.",
 "plugin": {
  "slug": "revenue",
  "name": "WowRevenue",
  "full_name": "WowRevenue – Product Bundles & Bulk Discounts",
  "wordpress_org": "https://wordpress.org/plugins/revenue/",
  "advisories_url": "https://wpsec.com/vuln/plugin/revenue/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/revenue"
 },
 "type": "IDOR",
 "cwe": [
  "CWE-639"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 3.7,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Low"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "3.1.0",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 3.1.0"
  ]
 },
 "introduced_in": null,
 "fixed_in": "3.1.0",
 "remediation": "Update to 3.1.0 or later.",
 "fix_released": "2026-10-27T09:02:07+00:00",
 "published": "2026-10-28T09:46:14+00:00",
 "updated": "2026-10-27T13:05:49.318999+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1821/",
  "https://plugins.svn.wordpress.org/revenue/tags/3.1.0/",
  "https://wordpress.org/plugins/revenue/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/revenue",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-28"
 }
}