# WowRevenue <= 2.3.2 - Unauthenticated Insecure Direct Object Reference to Order Products via Campaign Shortcode 'order' Parameter

- **ID:** WPSEC-2026-1821
- **Plugin:** WowRevenue – Product Bundles & Bulk Discounts (`revenue`), https://wordpress.org/plugins/revenue/
- **Affected versions:** all versions before 3.1.0
- **Fixed in:** 3.1.0 (Update to 3.1.0 or later.)
- **Severity:** Low 3.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-639
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-28)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/revenue
- **Fix released:** 2026-10-27
- **Published:** 2026-10-28
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1821/

## Description

The revenue plugin for WordPress is vulnerable to Insecure Direct Object Reference via the 'order' parameter in all versions up to, and including, 2.3.2. On the order-received (thank-you) page, the campaign shortcode loads whatever order ID is given in the 'order' query parameter and uses its first item as the product context, without checking the order key or that the visitor owns the order. This makes it possible for unauthenticated attackers to see the first purchased product of other customers' orders by enumerating order IDs, as long as a campaign shortcode that displays the context product (such as a volume discount campaign) is on the checkout page.

## References

- https://wpsec.com/vuln/WPSEC-2026-1821/
- https://plugins.svn.wordpress.org/revenue/tags/3.1.0/
- https://wordpress.org/plugins/revenue/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1821/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.